CVE-2024-49767
📋 TL;DR
Werkzeug versions before 3.0.6 contain a resource exhaustion vulnerability in the MultiPartParser that handles multipart/form-data requests. Attackers can craft malicious upload requests that cause the parser to allocate 3-8 times the upload size in memory, leading to denial of service through memory exhaustion. All Flask applications and other applications using vulnerable Werkzeug versions are affected.
💻 Affected Systems
- Werkzeug
- Flask
- Quart
- Any application using Werkzeug's MultiPartParser
📦 What is this software?
Quart by Palletsprojects
Werkzeug by Palletsprojects
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to memory exhaustion, potentially affecting multiple servers in a cluster if load balancers distribute malicious requests.
Likely Case
Service degradation or temporary unavailability for affected endpoints, requiring restart of application processes.
If Mitigated
Minimal impact with proper rate limiting, request size limits, and monitoring in place.
🎯 Exploit Status
The vulnerability is simple to exploit with crafted HTTP requests. Proof-of-concept code is available in the advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.6
Vendor Advisory: https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
Restart Required: Yes
Instructions:
1. Update Werkzeug to version 3.0.6 or later using pip: pip install --upgrade werkzeug>=3.0.6
2. Restart all application processes using Werkzeug
3. Verify the update with: pip show werkzeug
🔧 Temporary Workarounds
Implement request size limits
allConfigure web server or application to limit maximum request body size
# For nginx: client_max_body_size 10m;
# For Apache: LimitRequestBody 10485760
Rate limit upload endpoints
allImplement rate limiting on endpoints accepting file uploads
# Example using Flask-Limiter: @limiter.limit("10/minute")
🧯 If You Can't Patch
- Deploy Web Application Firewall (WAF) rules to block suspicious multipart requests
- Implement aggressive request timeout and connection limits at load balancer level
🔍 How to Verify
Check if Vulnerable:
Check Werkzeug version with: python -c "import werkzeug; print(werkzeug.__version__)" and verify it's < 3.0.6Check Version:
python -c "import werkzeug; print('Werkzeug version:', werkzeug.__version__)"Verify Fix Applied:
Confirm version is >= 3.0.6 and test file upload functionality remains operational📡 Detection & Monitoring
Log Indicators:
- Unusually large memory consumption spikes
- Application crashes or restarts during file uploads
- Slow response times on upload endpoints
Network Indicators:
- Large multipart/form-data requests to upload endpoints
- Multiple rapid upload requests from single IPs
SIEM Query:
source=application_logs ("multipart" OR "upload") AND ("memory" > threshold OR "crash" OR "restart")🔗 References
- https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee
- https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f
- https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b
- https://github.com/pallets/werkzeug/releases/tag/3.0.6
- https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
- https://security.netapp.com/advisory/ntap-20250103-0007/
