CVE-2024-29186— Bref 安全漏洞
一分钟漏洞结论
影响对象
brefphp bref
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Bref是Matthieu Napoli个人开发者的一个开源项目，可帮助您使用 PHP 在 AWS 上实现无服务器。 Bref 2.1.17之前版本存在安全漏洞，该漏洞源于攻击者可以发送专门设计的请求，迫使服务器执行长时间操作，从而导致长时间计费。
可能的 ATT&CK 技术 1 AI
T1496 · Resource Hijacking
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-29186 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Slow String Operations via MultiPart Requests in Event-Driven Functions
来源: CVE Program / CVE List V5
Vulnerability Description
Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed. In the parsing process, the `Content-Type` header of each part is read using the `Riverline/multipart-parser` library.
The library, in the `StreamedPart::parseHeaderContent` function, performs slow multi-byte string operations on the header value.
Precisely, the `mb_convert_encoding` function is used with the first (`$string`) and third (`$from_encoding`) parameters read from the header value.
An attacker could send specifically crafted requests which would force the server into performing long operations with a consequent long billed duration.
The attack has the following requirements and limitations: The Lambda should use the Event-Driven Function runtime and the `RequestHandlerInterface` handler and should implement at least an endpoint accepting POST requests; the attacker can send requests up to 6MB long (this is enough to cause a billed duration between 400ms and 500ms with the default 1024MB RAM Lambda image of Bref); and if the Lambda uses a PHP runtime <= php-82, the impact is higher as the billed duration in the default 1024MB RAM Lambda image of Bref could be brought to more than 900ms for each request. Notice that the vulnerability applies only to headers read from the request body as the request header has a limitation which allows a total maximum size of ~10KB.
Version 2.1.17 contains a fix for this issue.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
来源: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
来源: CVE Program / CVE List V5
Vulnerability Title
Bref 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Bref是Matthieu Napoli个人开发者的一个开源项目，可帮助您使用 PHP 在 AWS 上实现无服务器。 Bref 2.1.17之前版本存在安全漏洞，该漏洞源于攻击者可以发送专门设计的请求，迫使服务器执行长时间操作，从而导致长时间计费。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2024-29186 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-29186 的情报信息
请登录查看更多情报信息。
CVE-2024-29186 补丁与修复 (1)
CVE-2024-29186 厂商安全公告 (1)
-
https://github.com/brefphp/bref/security/advisories/GHSA-j4hq-f63x-f39r x_refsource_CONFIRM