FKIE_CVE-2024-24752

Vulnerability from fkie_nvd - Published: 2024-02-01 16:17 - Updated: 2024-11-21 08:59
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in `/tmp` with a random filename starting with `bref_upload_`. The flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed. An attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files. This vulnerability is patched in 2.1.13.
References
security-advisories@github.comhttps://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840ePatch
security-advisories@github.comhttps://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840ePatch
af854a3a-2127-422b-91ae-364da2661108https://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5Exploit, Vendor Advisory
Impacted products
Vendor Product Version
mnapoli bref *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mnapoli:bref:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8473D9F-5007-4ADC-B256-FD331BB522A0",
              "versionEndExcluding": "2.1.13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in `/tmp` with a random filename starting with `bref_upload_`. The flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed. An attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files. This vulnerability is patched in 2.1.13."
    },
    {
      "lang": "es",
      "value": "Bref habilita PHP sin servidor en AWS Lambda. Cuando se usa Bref con el tiempo de ejecuci\u00f3n de la funci\u00f3n controlada por eventos y el controlador es \"RequestHandlerInterface\", el evento Lambda se convierte en un objeto PSR7. Durante el proceso de conversi\u00f3n, si la solicitud es MultiPart, cada parte se analiza y, para cada una de las que contiene un archivo, se extrae y se guarda en `/tmp` con un nombre de archivo aleatorio que comienza con `bref_upload_`. El flujo imita lo que hace el PHP plano pero no elimina los archivos temporales cuando se procesa la solicitud. Un atacante podr\u00eda llenar el disco de la instancia de Lambda realizando m\u00faltiples solicitudes MultiPart que contengan archivos. Esta vulnerabilidad est\u00e1 parcheada en 2.1.13."
    }
  ],
  "id": "CVE-2024-24752",
  "lastModified": "2024-11-21T08:59:37.557",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-02-01T16:17:14.487",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840e"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.