CVE-2024-10907
📋 TL;DR
This vulnerability in lm-sys/fastchat v0.2.36 allows unauthenticated attackers to cause denial of service by sending malformed multipart requests with excessive characters in boundary fields. The server processes each extra character in an infinite loop, consuming excessive resources and making the service unavailable to all users. Anyone running the vulnerable version is affected.
💻 Affected Systems
- lm-sys/fastchat
📦 What is this software?
Fastchat by Lm Sys
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage with resource exhaustion leading to server crashes or unavailability for all users.
Likely Case
Service degradation or temporary unavailability due to resource exhaustion from DoS attacks.
If Mitigated
Minimal impact with proper rate limiting, input validation, and updated software.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.2.37 or later
Vendor Advisory: https://huntr.com/bounties/bf3ca81d-3508-4455-95d9-0b653e46d6e4
Restart Required: Yes
Instructions:
1. Update fastchat to v0.2.37 or later using pip: pip install --upgrade fschat>=0.2.37
2. Restart the fastchat server
3. Verify the update with: pip show fschat
🔧 Temporary Workarounds
Rate Limiting
allImplement request rate limiting to prevent excessive malformed requests from overwhelming the server.
Web Application Firewall
allDeploy WAF rules to block requests with malformed multipart boundaries.
🧯 If You Can't Patch
- Implement strict input validation for multipart boundaries at the application or proxy layer
- Isolate the vulnerable service behind reverse proxies with request filtering capabilities
🔍 How to Verify
Check if Vulnerable:
Check if running fastchat v0.2.36: pip show fschat | grep VersionCheck Version:
pip show fschat | grep VersionVerify Fix Applied:
Confirm version is v0.2.37 or later: pip show fschat | grep Version📡 Detection & Monitoring
Log Indicators:
- High CPU/memory usage spikes
- Multiple requests with malformed multipart boundaries
- Server restart logs
Network Indicators:
- Unusually high number of POST requests to multipart endpoints
- Requests with abnormally long boundary parameters
SIEM Query:
source="fastchat" AND (cpu_usage>90 OR memory_usage>90) OR http_request contains "boundary=" AND length(http_request) > 1000