Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-24753— Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2

Quick assessment

Affected
brefphp bref
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Bref是Matthieu Napoli个人开发者的一个开源项目，可帮助您使用 PHP 在 AWS 上实现无服务器。 Bref 2.1.13之前版本存在安全漏洞，该漏洞源于当 Bref 与 v2 格式的 API 网关结合使用时，不处理多个值标头。

CVSS 4.8 · Medium EPSS 0.43% · P37

Possible ATT&CK Techniques 1 AI

T1462
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-24753

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2
Source: CVE Program / CVE List V5
Vulnerability Description
Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
解释冲突
Source: CVE Program / CVE List V5
Vulnerability Title
Bref 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bref是Matthieu Napoli个人开发者的一个开源项目，可帮助您使用 PHP 在 AWS 上实现无服务器。 Bref 2.1.13之前版本存在安全漏洞，该漏洞源于当 Bref 与 v2 格式的 API 网关结合使用时，不处理多个值标头。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
brefphp bref < 2.1.13 -

II. Public POCs for CVE-2024-24753

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-24753

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-24753 (1)

Vendor Advisories for CVE-2024-24753 (1)

Same Patch Batch · brefphp · 2024-02-01 · 3 CVEs total

CVE-2024-24752 6.5 MEDIUM Bref Uploaded Files Not Deleted in Event-Driven Functions
CVE-2024-24754 3.7 LOW Bref Body Parsing Inconsistency in Event-Driven Functions

IV. Related Vulnerabilities

Same product: bref
Same vendor: brefphp
Same weakness: CWE-436