CVE-2022-24863
📋 TL;DR
CVE-2022-24863 is a denial-of-service vulnerability in http-swagger where improper HTTP method handling allows attackers to exhaust system memory. This affects all users running http-swagger versions before 1.2.6. Attackers can crash affected systems by sending specially crafted requests.
💻 Affected Systems
- http-swagger (swaggo/http-swagger)
📦 What is this software?
Http Swagger by Http Swagger Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability due to memory exhaustion, potentially affecting all services on the host
Likely Case
Service disruption and degraded performance of the http-swagger endpoint and potentially other services on the same host
If Mitigated
Minimal impact with proper HTTP method restrictions and resource monitoring
🎯 Exploit Status
Simple HTTP request manipulation can trigger the vulnerability without authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.6
Vendor Advisory: https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmv
Restart Required: Yes
Instructions:
1. Update go.mod to require github.com/swaggo/http-swagger v1.2.6 or later
2. Run 'go get -u github.com/swaggo/http-swagger'
3. Rebuild and redeploy your application
4. Restart the service
🔧 Temporary Workarounds
Restrict HTTP methods to GET only
allConfigure web server or application to only allow GET requests to the swagger endpoint
# Example for nginx:
location /swagger/ {
limit_except GET {
deny all;
}
}
# Example application middleware:
router.Handle("/swagger/*", httpSwagger.Handler()).Methods("GET")
🧯 If You Can't Patch
- Implement rate limiting on the swagger endpoint
- Deploy WAF rules to block suspicious HTTP method patterns
🔍 How to Verify
Check if Vulnerable:
Check go.mod or vendor dependencies for http-swagger version <1.2.6Check Version:
grep 'http-swagger' go.mod | grep -o 'v[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
Confirm http-swagger version is 1.2.6 or higher in go.mod and verify application functions correctly📡 Detection & Monitoring
Log Indicators:
- Unusual memory consumption spikes
- Multiple HTTP requests with non-GET methods to /swagger/* endpoints
- Process crashes or restarts
Network Indicators:
- High volume of HTTP requests to swagger endpoints with PUT, POST, DELETE methods
- Abnormal request patterns from single IPs
SIEM Query:
source="web_logs" AND uri="/swagger/*" AND method!="GET" | stats count by src_ip🔗 References
- https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e
- https://github.com/swaggo/http-swagger/pull/62
- https://github.com/swaggo/http-swagger/releases/tag/v1.2.6
- https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmv
- https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e
- https://github.com/swaggo/http-swagger/pull/62
- https://github.com/swaggo/http-swagger/releases/tag/v1.2.6
- https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmv
