CVE-2024-10051: Shaunwei Realchar DoS Vulnerability

CVE-2024-10051 Overview

CVE-2024-10051 is an unauthenticated denial of service (DoS) vulnerability in Realchar version 0.0.4. The flaw resides in the file upload request handler, which improperly processes multipart boundary strings. Attackers can append trailing characters, such as dashes (-), to the multipart boundary in an HTTP request. The server then iterates over each appended character, causing excessive CPU and memory consumption. The vulnerability requires no authentication and no user interaction, making the service unavailable to all users. This weakness is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Remote unauthenticated attackers can exhaust server resources with a single crafted HTTP request, rendering the Realchar service unavailable to all legitimate users.

Affected Products

Shaunwei Realchar version 0.0.4
Deployments exposing the Realchar file upload endpoint to untrusted networks
Self-hosted Realchar instances without upstream request filtering

Discovery Timeline

2025-03-20 - CVE-2024-10051 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10051

Vulnerability Analysis

The vulnerability affects Realchar's HTTP file upload handler when it parses multipart/form-data requests. The multipart parser does not enforce validation or length limits on the boundary token supplied in the Content-Type header. When an attacker appends additional characters, such as repeated dashes, to the end of the boundary string, the parser processes each character in a loop. This results in unbounded resource consumption on the server side.

The defect maps to [CWE-770] because the application allocates processing resources without applying throttling, rate limits, or input length constraints. A single malformed request can degrade or fully deny service. Because the endpoint is reachable without authentication, attackers do not need valid credentials or session context.

Root Cause

The root cause is missing input validation on the multipart boundary parameter. The parser trusts client-supplied boundary strings and iterates their contents without bounding the work performed. There is no maximum boundary length, no CPU quota per request, and no early rejection of malformed boundaries.

Attack Vector

Exploitation occurs over the network by sending a crafted HTTP POST request to Realchar's file upload endpoint. The attacker constructs a Content-Type: multipart/form-data; boundary= header where the boundary value is padded with trailing dashes or similar characters. The server enters an expensive processing loop for each request. Repeating the request in parallel amplifies the impact and can fully exhaust available worker processes. Refer to the Huntr Bounty Listing for verified technical details.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in prose only, per the referenced advisory.

Detection Methods for CVE-2024-10051

Indicators of Compromise

HTTP requests to Realchar upload endpoints containing Content-Type: multipart/form-data headers with unusually long or malformed boundary values
Sudden spikes in CPU utilization on the Realchar application process without a corresponding rise in legitimate traffic
Application worker threads stalled or unresponsive during multipart request parsing
Repeated inbound requests from a single source targeting the file upload path

Detection Strategies

Inspect web server and reverse proxy logs for multipart boundaries exceeding typical lengths (for example, greater than 70 characters)
Alert on abnormal request duration or memory allocation associated with the Realchar upload handler
Correlate process-level CPU saturation events with concurrent inbound HTTP POST requests

Monitoring Recommendations

Enable request-body and header logging at the reverse proxy layer to capture boundary strings for forensic review
Track resource metrics on the Realchar service and alert when sustained CPU usage exceeds baseline for more than 60 seconds
Monitor for repeated 5xx responses or worker restarts that correlate with upload endpoint traffic

How to Mitigate CVE-2024-10051

Immediate Actions Required

Restrict network access to the Realchar file upload endpoint using firewall rules or reverse proxy authentication
Deploy a web application firewall (WAF) rule that rejects multipart boundaries exceeding standard length (RFC 2046 allows up to 70 characters)
Enforce request rate limits and per-client concurrency limits on upload endpoints
Take affected Realchar 0.0.4 instances offline if they are internet-exposed and cannot be filtered upstream

Patch Information

No vendor patch or fixed release is listed in the NVD entry or the referenced advisory at the time of publication. Users of Realchar 0.0.4 should monitor the Huntr Bounty Listing and the upstream Realchar repository for a released fix.

Workarounds

Terminate TLS at a reverse proxy such as nginx and enforce client_max_body_size and client_header_buffer_size limits before requests reach Realchar
Add a WAF signature that drops requests whose Content-Type boundary parameter exceeds 70 characters or contains excessive trailing dashes
Place Realchar behind an authenticated gateway so anonymous requests cannot reach the upload handler

bash

# Configuration example: nginx reject overlong multipart boundaries
http {
    map $http_content_type $bad_boundary {
        default                                             0;
        "~*multipart/form-data;\s*boundary=[-A-Za-z0-9'()+_,./:=?]{71,}" 1;
    }

    server {
        listen 443 ssl;
        server_name realchar.example.com;

        client_max_body_size       10m;
        client_header_buffer_size  1k;
        large_client_header_buffers 4 8k;

        location /uploadfile {
            if ($bad_boundary) {
                return 400;
            }
            limit_req  zone=uploads burst=5 nodelay;
            proxy_pass http://realchar_upstream;
        }
    }
}