CVE-2024-23837 (published 2024-02-26T16:27Z)

LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/OISF/libhtp
commit_details: repo_url: https://github.com/OISF/libhtp
author: Philippe Antoine
author_date: 2023-11-08 09:42:50+01:00
msg: headers: limit the size of folded headers

Ticket: #6444

So as to limit the quadratic complexity of always reallocating
to push more bytes in header value
repository: repo_url: https://github.com/OISF/libhtp
repo_name: OISF/libhtp
description: LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. 
repo_language: C++
owner: OISF
file_changes: filename: htp_private.h
change_type: ModificationType.MODIFY
diff: @@ -262,5 +262,8 @@ size_t strlcpy(char *dst, const char *src, size_t size);
 }
 #endif
 
+// as CURL_MAX_HTTP_HEADER
+#define HTP_MAX_HEADER_FOLDED 102400
+
 #endif	/* _HTP_PRIVATE_H */
 

programming_language: C
filename: htp_request.c
change_type: ModificationType.MODIFY
diff: @@ -714,10 +714,14 @@ htp_status_t htp_connp_REQ_HEADERS(htp_connp_t *connp) {
                     connp->in_header = bstr_dup_mem(data + trim, len - trim);
                     if (connp->in_header == NULL) return HTP_ERROR;
                 } else {
-                    // Add to the existing header.                    
-                    bstr *new_in_header = bstr_add_mem(connp->in_header, data, len);
-                    if (new_in_header == NULL) return HTP_ERROR;
-                    connp->in_header = new_in_header;
+                    // Add to the existing header.
+                    if (bstr_len(connp->in_header) < HTP_MAX_HEADER_FOLDED) {
+                        bstr *new_in_header = bstr_add_mem(connp->in_header, data, len);
+                        if (new_in_header == NULL) return HTP_ERROR;
+                        connp->in_header = new_in_header;
+                    } else {
+                        htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request field length exceeds folded maximum");
+                    }
                 }
             }
 

programming_language: C
filename: htp_response.c
change_type: ModificationType.MODIFY
diff: @@ -978,10 +978,14 @@ htp_status_t htp_connp_RES_HEADERS(htp_connp_t *connp) {
                             return HTP_ERROR;
                     } else {
                         // Add to the existing header.
-                        bstr *new_out_header = bstr_add_mem(connp->out_header, data, len);
-                        if (new_out_header == NULL)
-                            return HTP_ERROR;
-                        connp->out_header = new_out_header;
+                        if (bstr_len(connp->out_header) < HTP_MAX_HEADER_FOLDED) {
+                            bstr *new_out_header = bstr_add_mem(connp->out_header, data, len);
+                            if (new_out_header == NULL)
+                                return HTP_ERROR;
+                            connp->out_header = new_out_header;
+                        } else {
+                            htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Response field length exceeds folded maximum");
+                        }
                     }
                 }
             }

programming_language: C