CVE-2024-24754 (published 2024-02-01T16:17Z)

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the `$files` or `$parsedBody` arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-436
cwe_name: Interpretation Conflict
description: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
extended_description: This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.
         

Fix information:
repo_url: https://github.com/brefphp/bref
commit_details: repo_url: https://github.com/brefphp/bref
author: Matthieu Napoli
author_date: 2024-01-29 10:20:41+01:00
msg: Cleanup uploaded files for PSR-15 handlers
repository: repo_url: https://github.com/brefphp/bref
repo_name: brefphp/bref
description: Serverless PHP on AWS Lambda
repo_language: PHP
owner: brefphp
file_changes: filename: Psr15Handler.php
change_type: ModificationType.MODIFY
diff: @@ -16,6 +16,8 @@ class Psr15Handler extends HttpHandler
 
     public function handleRequest(HttpRequestEvent $event, Context $context): HttpResponse
     {
+        Psr7Bridge::cleanupUploadedFiles();
+
         $request = Psr7Bridge::convertRequest($event, $context);
 
         $response = $this->psr15Handler->handle($request);

programming_language: PHP
filename: Psr7Bridge.php
change_type: ModificationType.MODIFY
diff: @@ -18,6 +18,8 @@ use function str_starts_with;
  */
 final class Psr7Bridge
 {
+    private const UPLOADED_FILES_PREFIX = 'bref_upload_';
+
     /**
      * Create a PSR-7 server request from an AWS Lambda HTTP event.
      */
@@ -106,7 +108,7 @@ final class Psr7Bridge
                     $parsedBody = [];
                     foreach ($document->getParts() as $part) {
                         if ($part->isFile()) {
-                            $tmpPath = tempnam(sys_get_temp_dir(), 'bref_upload_');
+                            $tmpPath = tempnam(sys_get_temp_dir(), self::UPLOADED_FILES_PREFIX);
                             if ($tmpPath === false) {
                                 throw new RuntimeException('Unable to create a temporary directory');
                             }
@@ -166,4 +168,19 @@ final class Psr7Bridge
 
         $pointer = $value;
     }
+
+    /**
+     * Cleanup previously uploaded files.
+     */
+    public static function cleanupUploadedFiles(): void
+    {
+        $tmpFiles = glob(sys_get_temp_dir() . '/' . self::UPLOADED_FILES_PREFIX . '*');
+        if ($tmpFiles !== false) {
+            foreach ($tmpFiles as $file) {
+                if(is_file($file)) {
+                    unlink($file);
+                }
+            }
+        }
+    }
 }

programming_language: PHP