CVE-2024-24752

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in `/tmp` with a random filename starting with `bref_upload_`. The flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed. An attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files. This vulnerability is patched in 2.1.13.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840e	Patch
https://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mnapoli:bref:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-01 16:17

Updated : 2024-02-09 01:45

NVD link : CVE-2024-24752

Mitre link : CVE-2024-24752

CVE.ORG link : CVE-2024-24752

JSON object : View

Products Affected

mnapoli

bref

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2024-24752", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-02-01T16:17:14.487", "references": [{"url": "https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in `/tmp` with a random filename starting with `bref_upload_`. The flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed. An attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files. This vulnerability is patched in 2.1.13."}, {"lang": "es", "value": "Bref habilita PHP sin servidor en AWS Lambda. Cuando se usa Bref con el tiempo de ejecuci\u00f3n de la funci\u00f3n controlada por eventos y el controlador es \"RequestHandlerInterface\", el evento Lambda se convierte en un objeto PSR7. Durante el proceso de conversi\u00f3n, si la solicitud es MultiPart, cada parte se analiza y, para cada una de las que contiene un archivo, se extrae y se guarda en `/tmp` con un nombre de archivo aleatorio que comienza con `bref_upload_`. El flujo imita lo que hace el PHP plano pero no elimina los archivos temporales cuando se procesa la solicitud. Un atacante podr\u00eda llenar el disco de la instancia de Lambda realizando m\u00faltiples solicitudes MultiPart que contengan archivos. Esta vulnerabilidad est\u00e1 parcheada en 2.1.13."}], "lastModified": "2024-02-09T01:45:17.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mnapoli:bref:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8473D9F-5007-4ADC-B256-FD331BB522A0", "versionEndExcluding": "2.1.13"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}