CVE-2024-45797
📋 TL;DR
CVE-2024-45797 is a resource exhaustion vulnerability in LibHTP, a widely-used HTTP parser library. Attackers can send specially crafted HTTP requests with excessive headers to cause denial of service through CPU and memory exhaustion. This affects any system using vulnerable versions of LibHTP, including Suricata IDS/IPS, Wazuh, and other security tools.
💻 Affected Systems
- Suricata
- Wazuh
- Security Onion
- Any application using LibHTP library
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through denial of service, potentially affecting critical security monitoring systems and causing cascading failures in dependent applications.
Likely Case
Performance degradation and intermittent service interruptions in systems processing HTTP traffic, particularly affecting security monitoring tools and web applications.
If Mitigated
Minimal impact with proper rate limiting, input validation, and updated versions, though some performance overhead may remain.
🎯 Exploit Status
Exploitation requires sending HTTP traffic to vulnerable systems. No authentication is needed, making this easily weaponizable in botnets or automated attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.49
Vendor Advisory: https://github.com/OISF/libhtp/security/advisories/GHSA-rqqp-24ch-248f
Restart Required: Yes
Instructions:
1. Update LibHTP to version 0.5.49 or later. 2. For Suricata: Update to version 7.0.6 or later. 3. For Wazuh: Update to version 4.9.0 or later. 4. Restart affected services after updating.
🔧 Temporary Workarounds
Rate limiting HTTP headers
allImplement rate limiting or size restrictions on HTTP headers at network perimeter devices or web application firewalls.
Suricata configuration tuning
linuxConfigure Suricata to limit maximum HTTP header size and processing time.
suricata -c /etc/suricata/suricata.yaml --set http.request-header-limit=8192
suricata -c /etc/suricata/suricata.yaml --set http.response-header-limit=8192
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from untrusted networks.
- Deploy web application firewalls with HTTP header size and count restrictions.
🔍 How to Verify
Check if Vulnerable:
Check LibHTP version: ldd /path/to/application | grep libhtp, then check version in library metadata.Check Version:
For Suricata: suricata --build-info | grep libhtpVerify Fix Applied:
Verify LibHTP version is 0.5.49 or later: strings /usr/lib/libhtp.so | grep 'libhtp version'📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes in LibHTP processes
- Memory exhaustion warnings
- HTTP parsing errors or timeouts
Network Indicators:
- Unusually large HTTP headers in traffic
- Multiple HTTP requests with excessive headers from single sources
SIEM Query:
source="suricata" AND (event_type="alert" AND alert.signature_id=* AND alert.signature="ET POLICY HTTP Request Header Overflow Attempt")