CVE-2024-29186: 
PHP vulnerability analysis and mitigation

Bref, an open-source project that helps users go serverless on Amazon Web Services with PHP, was found to contain a vulnerability (CVE-2024-29186) in versions prior to 2.1.17. The vulnerability affects the Event-Driven Function runtime when used with the RequestHandlerInterface handler, where the Lambda event conversion to PSR7 object process is susceptible to slow string operations during MultiPart request parsing (GitHub Advisory).

The vulnerability occurs during the parsing of MultiPart requests, specifically in the Content-Type header processing of each part using the Riverline/multipart-parser library. The StreamedPart::parseHeaderContent function performs slow multi-byte string operations on header values using the mb_convert_encoding function with parameters read from the header value. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L and is classified as CWE-400 (Uncontrolled Resource Consumption) (NVD).

An attacker can exploit this vulnerability by sending specifically crafted requests that force the server to perform long operations, resulting in increased billed duration. With the default 1024MB RAM Lambda image of Bref, requests up to 6MB can cause a billed duration between 400ms and 500ms. The impact is more severe for Lambda instances using PHP runtime <= php-82, where the billed duration could exceed 900ms per request. The vulnerability only affects headers read from the request body, as request headers are limited to approximately 10KB (GitHub Advisory).

The vulnerability can be exploited when the following conditions are met: the Lambda must use the Event-Driven Function runtime, implement the RequestHandlerInterface handler, and have at least one endpoint accepting POST requests. The attack vector involves sending specifically crafted MultiPart requests with manipulated Content-Type headers (GitHub Advisory).

The vulnerability has been patched in version 2.1.17 of Bref, which includes additional validation on the headers parsed via the StreamedPart::parseHeaderContent function to allow only legitimate headers with a reasonable length. Users should upgrade to this version to address the security issue (GitHub Commit).