PT-2024-20530 · Bref · Bref
Smaury
·
Published
2024-02-01
·
Updated
2024-10-17
·
CVE-2024-24752
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Bref versions prior to 2.1.13
Description
The issue arises when Bref is used with the Event-Driven Function runtime and the handler is a
RequestHandlerInterface. In this scenario, the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed, and for each part that contains a file, it is extracted and saved in /tmp with a random filename starting with bref upload . However, the temporary files are not deleted after the request has been processed, allowing an attacker to fill the Lambda instance disk by performing multiple MultiPart requests containing files.Recommendations
For versions prior to 2.1.13, update to version 2.1.13 or later to resolve the issue. As a temporary workaround, consider implementing a mechanism to delete the temporary files after the request has been processed and the response has been generated. Restrict access to the
/tmp directory to minimize the risk of exploitation. Avoid using the RequestHandlerInterface handler with the Event-Driven Function runtime until the issue is resolved.Exploit
Fix
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Bref