GHSA-j4hq-f63x-f39r Slow String Operations via MultiPart Requests in Event-Driven Functions

• Packagist bref/bref: < 2.1.17 → fixed in 2.1.17

Impacted Resources bref/src/Event/Http/Psr7Bridge.php:94-125 multipart-parser/src/StreamedPart.php:383-418 Description When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed. In the parsing process, the `Content-Type` header of each part is read using the `Riverline/multipart-parser` library. The library, in the `StreamedPart::parseHeaderContent` function, performs slow multi-byte string operations on the header value. Precisely, the `mb_convert_encoding` function is used with the first (`$string`) and third (`$from_encoding`) parameters read from the header value. Impact An attacker could send specifically crafted requests which would force the server into performing long operations with a consequent long billed duration. The attack has the following requirements and limitations: • The Lambda should use the Event-Driven Function runtime. • The Lambda should use the `RequestHandlerInterface` handler. • The Lambda should implement at least an endpoint accepting POST requests. • The attacker can send requests up to 6MB long (this is enough to cause a billed duration between 400ms and 500ms with the default 1024MB RAM Lambda image of Bref). • If the Lambda uses a PHP runtime ") exit() url = f"https://{argv[1]}/endpoint" headers = {"Content-Type": "multipart/form-data; boundary=a"} data_normal = f"--a\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\nContent-Type: ;*=auto''{('a'*(4717792))}'\r\n--a--\r\n" data_malicious = f"--a\r\nContent-Disposition: form-data; name=\"0\"\r\nContent-Type: ;*=auto''{('a'*(4717792))}'\r\n\r\n\r\n--a--\r\n" print("[+] Sending normal request") post(url, headers=headers, data=data_normal) print("[+] Sending malicious request") post(url, headers=headers, data=data_malicious) ``` 5. Observe the CloudWatch logs of the Lambda and notice that the first requests used less than 200ms of billed duration, while the second one, which has a malicious `Content-Type` header, used more than 400ms of billed duration. Suggested Remediation Perform an additional validation on the headers parsed via the `StreamedPart::parseHeaderContent` function to allow only legitimate headers with a reasonable length.