CVE-2024-31744

Executive Summary

CVE-2024-31744 is a denial-of-service (DoS) vulnerability in the Jasper library (version 4.2.2), specifically within the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c. The flaw is triggered by a crafted image file that causes an assertion failure, leading to a crash. With a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, this vulnerability currently has low exploitation activity, but it poses a risk to any application or service that processes JPEG-2000 images using the vulnerable Jasper library. No official patch exists, and the vendor has not responded to disclosures.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Local (requires a crafted file)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): Required (user must open the file)
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High (crash)
• EPSS Score: 0.0% (low probability of exploitation)
• Threat Level: Low (due to low EPSS and no active exploits)

Deep Dive & Mechanics

The vulnerability resides in the jpc_streamlist_remove function at line 2407 of src/libjasper/jpc/jpc_dec.c. This function is responsible for removing a stream from a stream list. The assertion failure occurs when the function attempts to access an invalid index or perform an operation on a corrupted data structure, likely due to a malformed JPEG-2000 codestream.

Root Cause: The function lacks proper bounds checking or input validation before performing the removal operation. A crafted image can cause the stream list to be in an inconsistent state, triggering an assert() macro that aborts the process.

Impact: An attacker can cause a denial-of-service condition by convincing a user or automated system to process a specially crafted JPEG-2000 file. This can crash applications that use Jasper for image decoding (e.g., image viewers, web services, document processors).

Vulnerable vs. Patched Code

Vulnerable Code (Jasper 4.2.2):

// src/libjasper/jpc/jpc_dec.c:2407
void jpc_streamlist_remove(jpc_streamlist_t *streamlist, int streamno)
{
    assert(streamno < streamlist->numstreams);
    // ... removal logic
}

Patched Code (Hypothetical fix):

// src/libjasper/jpc/jpc_dec.c:2407
void jpc_streamlist_remove(jpc_streamlist_t *streamlist, int streamno)
{
    if (streamno < 0 || streamno >= streamlist->numstreams) {
        // Handle error gracefully instead of asserting
        return;
    }
    // ... removal logic
}

Note: No official patch exists. The fix would involve replacing the assert() with proper error handling and bounds checking.

Exploitation & Lab Setup

Red Team (Proof of Concept)

1. Craft a malicious JPEG-2000 file that triggers the assertion failure. This can be done by manipulating the stream list metadata in the codestream.
2. Deliver the file via email, web download, or other means.
3. Target application processes the file using Jasper 4.2.2.

Example PoC (Python):

# This is a conceptual PoC; actual crafting requires deep knowledge of JPEG-2000 format.
import struct

def create_malicious_j2k():
    # Craft a minimal JPEG-2000 codestream with corrupted stream list
    # This is a simplified example; real exploit requires precise byte manipulation
    data = b'\x00' * 100  # Placeholder
    with open('malicious.j2k', 'wb') as f:
        f.write(data)

create_malicious_j2k()

Blue Team (Detection & Prevention)

• Input Validation: Validate JPEG-2000 files before processing (e.g., check file size, magic bytes, structure).
• Sandboxing: Run image processing in a sandboxed environment with limited resources.
• Monitoring: Monitor for crashes or assertion failures in applications using Jasper.
• Alternative Libraries: Consider using OpenJPEG or other maintained JPEG-2000 libraries.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash depends on crafted file)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• File Names: malicious.j2k, exploit.jp2, crafted.jpc
• Process Behavior: Application crash with assertion failure in jpc_streamlist_remove
• Log Entries: assertion "streamno < streamlist->numstreams" failed

Detection Engineering

YARA Rule

rule CVE_2024_31744_Jasper_DoS {
    meta:
        description = "Detects crafted JPEG-2000 files targeting CVE-2024-31744"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-31744"
    strings:
        $jpc_magic = { FF 4F FF 51 }  // JPEG-2000 codestream magic bytes
        $assert_string = "jpc_streamlist_remove" nocase
    condition:
        $jpc_magic at 0 and $assert_string
}

Sigma Rule

title: CVE-2024-31744 Jasper DoS Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects application crashes due to assertion failure in Jasper library
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: generic
detection:
    selection:
        EventID: 1000  # Application Error (Windows)
        Message|contains: "jpc_streamlist_remove"
    condition: selection
falsepositives:
    - Legitimate crashes from other bugs
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-31744 Jasper JPEG-2000 DoS Attempt"; flow:to_server,established; content:"|FF 4F FF 51|"; depth:4; content:"jpc_streamlist_remove"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable JPEG-2000 support in applications using Jasper 4.2.2, or switch to an alternative library (e.g., OpenJPEG).
2. Short-term: Apply input validation to reject malformed JPEG-2000 files.
3. Long-term: Monitor for an official patch from the Jasper project. If none is released, consider forking the library and applying the fix (replace assert() with error handling).
4. Workaround: Use a Web Application Firewall (WAF) or file upload scanner to block suspicious JPEG-2000 files.

Valters IT
DevSecOps & Cyber Threat Intelligence