CVE-2024-50596
📋 TL;DR
An integer underflow vulnerability in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL allows attackers to cause denial of service via specially crafted network packets. This affects devices running the NetX Duo Web Component HTTP Server implementation. Embedded systems and IoT devices using this middleware are vulnerable.
💻 Affected Systems
- STMicroelectronics X-CUBE-AZRTOS-WL
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or reboot, rendering the device unavailable until manual intervention.
Likely Case
HTTP server process crashes, disrupting web services while other system functions may continue.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and block malicious packets.
🎯 Exploit Status
Exploitation requires crafting specific HTTP PUT request packets but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check STMicroelectronics for updated version
Vendor Advisory: https://www.st.com
Restart Required: Yes
Instructions:
1. Check STMicroelectronics security advisory for patch details
2. Update to patched version of X-CUBE-AZRTOS-WL
3. Rebuild and redeploy firmware
4. Restart affected devices
🔧 Temporary Workarounds
Disable HTTP PUT method
allConfigure HTTP server to reject or disable PUT requests if not required.
Modify nx_web_http_server.c configuration to restrict PUT method
Network filtering
allUse firewalls or IPS to block malicious HTTP PUT packets.
Configure network devices to inspect and filter HTTP traffic for abnormal PUT requests
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable devices from untrusted networks.
- Deploy intrusion detection systems to monitor for exploitation attempts and alert on abnormal HTTP traffic.
🔍 How to Verify
Check if Vulnerable:
Check if system uses X-CUBE-AZRTOS-WL 2.0.0 with NetX Duo Web Component HTTP Server enabled.Check Version:
Check firmware version or middleware version in device configurationVerify Fix Applied:
Verify updated firmware version and test HTTP PUT functionality with normal requests.📡 Detection & Monitoring
Log Indicators:
- HTTP server crash logs
- Abnormal process termination
- Repeated failed HTTP PUT requests
Network Indicators:
- Malformed HTTP PUT packets
- Unusual traffic patterns to HTTP ports
- DoS attack signatures
SIEM Query:
source="http_server" AND (event="crash" OR event="abnormal_termination")