CVE-2024-9437
📋 TL;DR
SuperAGI v0.0.14 is vulnerable to an unauthenticated Denial of Service attack where attackers can crash the service by sending specially crafted HTTP requests with malformed multipart boundaries. This affects all users of vulnerable SuperAGI instances, requiring no authentication or user interaction.
💻 Affected Systems
- SuperAGI
📦 What is this software?
Superagi by Superagi
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage making SuperAGI unavailable to all users, potentially disrupting AI workflows and business operations.
Likely Case
Service becomes unresponsive under attack, requiring manual restart and causing temporary disruption.
If Mitigated
Minimal impact with proper rate limiting, request validation, and monitoring in place.
🎯 Exploit Status
Attack requires sending specially crafted HTTP requests but no authentication or complex exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after v0.0.14
Vendor Advisory: https://huntr.com/bounties/27404e9c-eb3d-4626-a9d9-8dc1b3295ce0
Restart Required: Yes
Instructions:
1. Update SuperAGI to latest version. 2. Restart the SuperAGI service. 3. Verify the fix by testing with malformed boundary requests.
🔧 Temporary Workarounds
Implement request validation
allAdd middleware or WAF rules to validate multipart boundary format before processing
Rate limiting
allImplement rate limiting on resource upload endpoints to limit DoS impact
🧯 If You Can't Patch
- Deploy a WAF with rules to block malformed multipart boundaries
- Restrict access to SuperAGI endpoints to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check SuperAGI version via web interface or configuration files for v0.0.14Check Version:
Check SuperAGI configuration or package manager for installed versionVerify Fix Applied:
Test with crafted HTTP request containing malformed multipart boundary with appended dashes📡 Detection & Monitoring
Log Indicators:
- Multiple failed upload requests
- High CPU/memory usage spikes
- Service restart logs
Network Indicators:
- Unusual HTTP requests with malformed boundaries
- High volume of upload requests from single source
SIEM Query:
source="superagi" AND (http_request contains "multipart/form-data" AND boundary contains "--")