CVE-2024-34402
📋 TL;DR
This vulnerability in uriparser allows attackers to trigger an integer overflow when processing long query keys or values, leading to buffer overflow. This could enable remote code execution or denial of service attacks. Any application using vulnerable versions of uriparser to parse URIs is affected.
💻 Affected Systems
- uriparser
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Uriparser by Uriparser Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application using uriparser, potentially leading to complete system compromise.
Likely Case
Denial of service through application crash, with potential for information disclosure via memory leaks.
If Mitigated
Application crash without code execution if memory protections like ASLR are enabled.
🎯 Exploit Status
Exploitation requires crafting malicious URIs with long query parameters to trigger the overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.8 and later
Vendor Advisory: https://github.com/uriparser/uriparser/issues/183
Restart Required: Yes
Instructions:
1. Update uriparser to version 0.9.8 or later. 2. Recompile any applications using uriparser. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation
allImplement strict length limits on URI query keys and values before passing to uriparser.
Disable vulnerable functionality
allIf possible, disable URI query parsing in affected applications.
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy web application firewall with URI length restrictions
🔍 How to Verify
Check if Vulnerable:
Check if uriparser version is 0.9.7 or earlier using package manager or ldd/ldconfig.Check Version:
pkg-config --modversion uriparser # or check package managerVerify Fix Applied:
Verify uriparser version is 0.9.8 or later and applications have been recompiled.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Unusually long URI queries in access logs
Network Indicators:
- HTTP requests with extremely long query parameters
- Multiple failed requests to URI parsing endpoints
SIEM Query:
source="web_logs" AND uri_query_length>1000🔗 References
- http://www.openwall.com/lists/oss-security/2024/05/06/1
- http://www.openwall.com/lists/oss-security/2024/05/06/3
- https://github.com/uriparser/uriparser/issues/183
- https://github.com/uriparser/uriparser/pull/185
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R36L762D3KX3GA66OOPWW7M7KKDRXDP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ6KEUQXWCTYXGTBMZDD7CHJCYI52XY3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UG4J7PD475LSCGCSHFU4GMU4TWLDSNW2/
- http://www.openwall.com/lists/oss-security/2024/05/06/1
- http://www.openwall.com/lists/oss-security/2024/05/06/3
- https://github.com/uriparser/uriparser/issues/183
- https://github.com/uriparser/uriparser/pull/185
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R36L762D3KX3GA66OOPWW7M7KKDRXDP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ6KEUQXWCTYXGTBMZDD7CHJCYI52XY3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UG4J7PD475LSCGCSHFU4GMU4TWLDSNW2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R36L762D3KX3GA66OOPWW7M7KKDRXDP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ6KEUQXWCTYXGTBMZDD7CHJCYI52XY3/
