PT-2024-20531 · Bref · Bref

Smaury · Published 2024-02-01 · Updated 2024-02-09 · CVE-2024-24753

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bref versions prior to 2.1.13

Description The issue arises when Bref is used in combination with an API Gateway with the v2 format, as it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values, only the latest one is kept. This can lower application security if an application relies on multiple headers with the same key being set for security reasons. For example, if an application sets multiple Content-Security-Policy headers, Bref would just reflect the latest one.

Recommendations For versions prior to 2.1.13, update to version 2.1.13 to resolve the issue. As a temporary workaround, consider concatenating all multiple value headers' values with a comma (,) as separator and return a single header with all the values to the API Gateway.

Exploit

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2024-24753

GHSA-99F9-GV72-FW9R

Affected Products

Bref

References · 13

• 🔥 https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24753.json · Exploit
• https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc · Patch
• https://osv.dev/vulnerability/CVE-2024-24753 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99f9-gv72-fw9r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24753 · Security Note
• https://github.com/brefphp/bref · Note
• https://github.com/brefphp/bref/blob/2.1.12/src/Event/Http/HttpResponse.php#L61-L90 · Note
• https://t.me/cvenotify/70722 · Telegram Post
• https://twitter.com/CVEnew/status/1753095406706417954 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1753110067598205206 · Twitter Post
• https://twitter.com/RedPacketSec/status/1754083394466513001 · Twitter Post
• https://t.me/cvenotify/69632 · Telegram Post