CVE-2024-24752: Bref's Uploaded Files Not Deleted in Event-Driven Functions
Summary
CVE-2024-24752: Bref's Uploaded Files Not Deleted in Event-Driven Functions. Affects bref/bref versions < 2.1.13. Fixed in 2.1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bref is an open-source project that allows developers to build serverless applications using PHP. It provides a framework for running PHP functions in response to events, such as HTTP requests. The vulnerable component in Bref is the Psr7Bridge class, specifically the parseBodyAndUploadedFiles method. This method is responsible for converting Lambda events to PSR7 objects and handling multipart requests. When a multipart request contains files, Bref saves them in temporary files in the /tmp directory. However, it fails to delete these temporary files after processing the request, leading to a potential disk space exhaustion vulnerability.
Vulnerability Detail
The vulnerability allows an attacker to fill the disk space of a Lambda instance by sending multiple multipart requests containing files. To exploit this vulnerability, the Lambda function must use the Event-Driven Function runtime, have a RequestHandlerInterface handler, and implement an endpoint that accepts POST requests. The attacker can send requests up to 6MB in size, requiring multiple requests to fill the disk. The impact of this vulnerability is limited to the affected Lambda instance's disk space.
How To Fix
Minimum fixed version
2.1.13
This is the first release that contains the fix.
composer require bref/bref:2.1.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually delete the temporary files in the /tmp directory after each request. This can be done using the unlink function in PHP. However, it is recommended to apply the official fix provided by the Bref project.
Conclusion
The Bref project is vulnerable to a disk space exhaustion vulnerability when using the Event-Driven Function runtime and a RequestHandlerInterface handler. Attackers can exploit this vulnerability by sending multiple multipart requests containing files. The impact is limited to the affected Lambda instance's disk space. To fix this vulnerability, the Bref project developers should modify the affected method to delete the temporary files after processing the request. Users can also manually delete the temporary files as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bref/bref →
FAQ
Bref is an open-source project that enables developers to build serverless applications using PHP. It provides a framework for running PHP functions in response to events, such as HTTP requests.
The vulnerability allows an attacker to fill the disk space of a Lambda instance by sending multiple multipart requests containing files. However, the impact is limited to the affected Lambda instance's disk space.
To exploit this vulnerability, the Lambda function must use the Event-Driven Function runtime, have a RequestHandlerInterface handler, and implement an endpoint that accepts POST requests.
To fix this vulnerability, the Bref project developers should modify the parseBodyAndUploadedFiles method in the Psr7Bridge class to delete the temporary files after processing the request and generating the response.
As a temporary workaround, users can manually delete the temporary files in the /tmp directory after each request. However, it is recommended to apply the official fix provided by the Bref project.
References
Related vulnerabilities
Recent vulnerabilities recorded for bref/bref.
