CVE-2024-28871
📋 TL;DR
CVE-2024-28871 is a denial-of-service vulnerability in LibHTP's HTTP parser where malformed request traffic causes excessive CPU usage. This affects any system using LibHTP version 0.5.46 for HTTP parsing, potentially leading to service degradation or unavailability. The vulnerability is fixed in version 0.5.47.
💻 Affected Systems
- LibHTP
- Suricata (when using LibHTP)
- Other products embedding LibHTP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage due to CPU exhaustion, making affected systems unresponsive to legitimate traffic.
Likely Case
Performance degradation and intermittent service disruptions under sustained malicious traffic.
If Mitigated
Minimal impact with proper monitoring and rapid response to anomalous CPU spikes.
🎯 Exploit Status
Exploitation requires sending malformed HTTP requests, which is straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.47
Vendor Advisory: https://github.com/OISF/libhtp/security/advisories/GHSA-ffr2-45w9-7wmg
Restart Required: Yes
Instructions:
1. Identify systems using LibHTP 0.5.46
2. Update to LibHTP 0.5.47 via package manager or source compilation
3. Restart affected services using LibHTP
4. Verify version update with 'libhtp-config --version' or equivalent
🔧 Temporary Workarounds
No official workarounds
allThe advisory states no known workarounds exist. Patching is the only mitigation.
🧯 If You Can't Patch
- Implement network filtering to block malformed HTTP traffic at perimeter devices
- Deploy rate limiting and anomaly detection to identify and block DoS attempts
🔍 How to Verify
Check if Vulnerable:
Check LibHTP version: 'libhtp-config --version' or examine package manager output. Version 0.5.46 is vulnerable.Check Version:
libhtp-config --versionVerify Fix Applied:
Confirm version is 0.5.47 or higher using version check command and monitor CPU usage during normal traffic.📡 Detection & Monitoring
Log Indicators:
- Unusual CPU spikes in monitoring logs
- HTTP parsing errors or malformed request logs
Network Indicators:
- High volume of malformed HTTP requests to affected systems
- Abnormal traffic patterns causing CPU alerts
SIEM Query:
source="*cpu*" AND (message="*high*" OR message="*spike*") AND host="*affected-system*"🔗 References
- https://github.com/OISF/libhtp/commit/79e713f3e527593a45f545e854cd9e6fbb3cd3ed
- https://github.com/OISF/libhtp/commit/bf618ec7f243cebfb0f7e84c3cb158955cb32b4d
- https://github.com/OISF/libhtp/security/advisories/GHSA-ffr2-45w9-7wmg
- https://redmine.openinfosecfoundation.org/issues/6757
- https://github.com/OISF/libhtp/commit/79e713f3e527593a45f545e854cd9e6fbb3cd3ed
- https://github.com/OISF/libhtp/commit/bf618ec7f243cebfb0f7e84c3cb158955cb32b4d
- https://github.com/OISF/libhtp/security/advisories/GHSA-ffr2-45w9-7wmg
- https://redmine.openinfosecfoundation.org/issues/6757
