CVE-2024-2757
📋 TL;DR
This vulnerability in PHP's mb_encode_mimeheader() function causes infinite loops when processing specific input patterns, leading to denial of service. Any PHP application using this function with untrusted input is affected, particularly web applications processing user-submitted data for email headers or MIME encoding.
💻 Affected Systems
- PHP
📦 What is this software?
Php by Php
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion from infinite loops, potentially affecting multiple services on shared infrastructure.
Likely Case
Targeted DoS attacks against vulnerable endpoints causing service degradation or temporary outages.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation requires sending crafted input to applications using the vulnerable function. No authentication needed if the vulnerable endpoint is publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PHP 8.3.5
Vendor Advisory: https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq
Restart Required: Yes
Instructions:
1. Update PHP to version 8.3.5 or later. 2. For Linux: Use package manager (apt-get upgrade php, yum update php, etc.). 3. For Windows: Download and install from php.net. 4. Restart web server/service (Apache, Nginx, PHP-FPM).
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize input before passing to mb_encode_mimeheader() function
Disable mbstring Extension
allRemove or disable mbstring extension if not required (breaks mb_encode_mimeheader functionality)
php -m | grep mbstring
Comment out extension=mbstring in php.ini
🧯 If You Can't Patch
- Implement strict input validation and length limits for data passed to mb_encode_mimeheader()
- Deploy WAF rules to block suspicious patterns in input to vulnerable endpoints
🔍 How to Verify
Check if Vulnerable:
Check PHP version and if mbstring extension is loaded: php -v && php -m | grep mbstringCheck Version:
php -v | head -1Verify Fix Applied:
Confirm PHP version is 8.3.5 or higher: php -v📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes on PHP processes
- Increased mb_encode_mimeheader function calls
- Request timeouts on specific endpoints
Network Indicators:
- Repeated requests with long strings to endpoints using email/MIME functionality
- Unusual patterns in user input containing long non-space character sequences
SIEM Query:
source="php_error.log" AND ("mb_encode_mimeheader" OR "execution time exceeded")🔗 References
- http://www.openwall.com/lists/oss-security/2024/04/12/11
- https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq
- https://security.netapp.com/advisory/ntap-20240510-0011/
- http://www.openwall.com/lists/oss-security/2024/04/12/11
- https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/
- https://security.netapp.com/advisory/ntap-20240510-0011/
