CVE-2024-24754: Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions
Summary
CVE-2024-24754: Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions. Affects bref/bref versions < 2.1.13. Fixed in 2.1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bref is an open-source package available on Packagist that provides support for running PHP applications on AWS Lambda using the Event-Driven Function runtime. It allows developers to convert Lambda events to PSR7 objects when the handler is a RequestHandlerInterface. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the $files or $parsedBody arrays. However, there is a vulnerability in the body parsing logic that leads to inconsistent results compared to plain PHP when keys ending with an open square bracket ([) are used.
Vulnerability Detail
The vulnerability in Bref's body parsing logic can result in different output compared to plain PHP when keys ending with an open square bracket are used. This inconsistency in parsing can have various impacts depending on the application logic and may lead to vulnerabilities or undefined behaviors. An attacker could potentially exploit this inconsistency to manipulate the parsed data and bypass security measures. The vulnerability has a CVSS score of 3.7, indicating a low severity level.
How To Fix
Minimum fixed version
2.1.13
This is the first release that contains the fix.
composer require bref/bref:2.1.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, Bref is vulnerable to a body parsing inconsistency in event-driven functions. This vulnerability can have various impacts depending on the application logic and may lead to security vulnerabilities or undefined behaviors. It is recommended to update to the latest version of Bref (2.1.13 or later) and use the parse_str function for consistent and secure parsing of multipart requests. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bref/bref →
FAQ
Bref is an open-source package that enables running PHP applications on AWS Lambda using the Event-Driven Function runtime.
The impact of this vulnerability depends on the application logic. It can lead to inconsistent parsing of multipart requests, potentially resulting in vulnerabilities or undefined behaviors.
To fix this vulnerability, update the Bref package to version 2.1.13 or later. Additionally, use the PHP function parse_str to parse the body parameters in a consistent and secure manner.
No specific workaround has been mentioned for this vulnerability.
The severity level of this vulnerability is low, with a CVSS score of 3.7.
References
Related vulnerabilities
Recent vulnerabilities recorded for bref/bref.
