PT-2024-20532 · Bref · Bref
Smaury
·
Published
2024-02-01
·
Updated
2024-02-09
·
CVE-2024-24754
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Bref versions prior to 2.1.13
Description
The vulnerability occurs when Bref is used with the Event-Driven Function runtime and the handler is a
RequestHandlerInterface. In this scenario, the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the $files or $parsedBody arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with an open square bracket ([) are used. This difference in body parsing might lead to vulnerabilities and/or undefined behaviors based on the application logic.Recommendations
For versions prior to 2.1.13, update to version 2.1.13 or later to patch the vulnerability. As a temporary workaround, consider using the PHP function
parse str to parse the body parameters and mimic the plain PHP behavior. Restrict access to the vulnerable RequestHandlerInterface to minimize the risk of exploitation until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bref