CVE-2024-24753

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-24753
Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc Patch
https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mnapoli:bref:*:*:*:*:*:*:*:*
History

09 Feb 2024, 01:46

Type Values Removed Values Added
CPE cpe:2.3:a:mnapoli:bref:*:*:*:*:*:*:*:*
First Time Mnapoli
Mnapoli bref
References () https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc - () https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc - Patch
References () https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r - () https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r - Exploit, Vendor Advisory
CVSS v2 : unknown
v3 : 4.8 		v2 : unknown
v3 : 6.5
Summary
  • (es) Bref habilita PHP sin servidor en AWS Lambda. Cuando Bref se usa en combinación con una API Gateway con el formato v2, no maneja encabezados de valores múltiples. Si PHP genera una respuesta con dos encabezados que tienen la misma clave pero valores diferentes, solo se conserva el último. Si una aplicación se basa en varios encabezados con la misma clave configurada por razones de seguridad, Bref reduciría la seguridad de la aplicación. Por ejemplo, si una aplicación establece varios encabezados "Content-Security-Policy", Bref solo reflejará el último. Esta vulnerabilidad está parcheada en 2.1.13.

01 Feb 2024, 20:50

Type Values Removed Values Added
Summary (en) Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.12. (en) Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.
References
  • () https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc -

01 Feb 2024, 16:17

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-01 16:17

Updated : 2024-02-09 01:46

NVD link : CVE-2024-24753

Mitre link : CVE-2024-24753

CVE.ORG link : CVE-2024-24753

JSON object : View

Products Affected

mnapoli

  • bref
CWE
CWE-436

Interpretation Conflict