CVE-2024-24753: Mnapoli Bref Information Disclosure Flaw

CVE-2024-24753 Overview

CVE-2024-24753 affects Bref, a framework that enables serverless PHP execution on AWS Lambda. When Bref runs behind an API Gateway configured with the v2 payload format, it fails to handle HTTP responses containing multiple headers that share the same key. Only the last value is retained, silently dropping the others. Applications that rely on multiple headers with the same key for security controls, such as duplicate Content-Security-Policy directives, receive weaker protection than intended. The issue is classified under [CWE-436] Interpretation Conflict and is patched in Bref version 2.1.13.

Critical Impact
Security headers emitted by the PHP application can be silently dropped before reaching the browser, weakening defenses that depend on multiple same-key headers such as Content Security Policy.

Affected Products

Bref (mnapoli/bref) versions prior to 2.1.13
PHP applications deployed on AWS Lambda through Bref
Deployments fronted by AWS API Gateway using the v2 payload format

Discovery Timeline

2024-02-01 - CVE-2024-24753 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24753

Vulnerability Analysis

Bref translates AWS Lambda invocations into HTTP responses that API Gateway forwards to clients. API Gateway v2 payload format does not natively support multi-value headers, so Bref serialized the response headers into a flat associative array. When the PHP application emitted the same header name more than once, Bref kept only the final occurrence and discarded prior values.

This behavior breaks security controls that depend on multiple headers with the same key. For example, applications commonly set two Content-Security-Policy headers, one enforcing a strict policy and another as a report-only baseline. Under vulnerable versions of Bref, only the last policy reaches the client, silently relaxing the intended restrictions.

The flaw does not require authentication or user interaction. Any deployment matching the affected topology exposes downgraded response headers to every request.

Root Cause

The root cause resides in src/Event/Http/HttpResponse.php. When header values arrived as an array, the code called end($values) and stored only the last element, dropping every earlier value.

Attack Vector

Exploitation is passive rather than direct. An attacker does not send a crafted request to trigger the flaw. Instead, the missing security headers weaken client-side protections that would otherwise block cross-site scripting, framing, or policy violations. Once a Bref deployment strips duplicate Content-Security-Policy headers, an attacker who finds an injection primitive in the PHP application can operate against the reduced policy surface.

php

            } else {
                // Make sure the values are never arrays
                // because API Gateway v2 does not support multi-value headers
-                $headers[$name] = is_array($values) ? end($values) : $values;
+                $headers[$name] = is_array($values) ? implode(', ', $values) : $values;
            }
        }

Source: GitHub Commit f834027 - brefphp/bref

The patch replaces end($values) with implode(', ', $values), concatenating repeated header values into a single comma-separated string. This preserves each directive while conforming to the API Gateway v2 single-value header constraint.

Detection Methods for CVE-2024-24753

Indicators of Compromise

HTTP responses from Bref-hosted endpoints missing expected duplicate security headers such as Content-Security-Policy, Set-Cookie, or Link.
Composer lock files or deployment artifacts referencing mnapoli/bref at versions below 2.1.13.
API Gateway routes configured with the v2 payload format that forward to Lambda functions running Bref.

Detection Strategies

Inventory Lambda functions and inspect their runtime bundles for bref package versions using composer show mnapoli/bref in CI pipelines.
Send test requests to production endpoints and compare returned headers against the application's expected security header set.
Query CloudFormation or Terraform state files for API Gateway integrations tagged with PayloadFormatVersion: 2.0 combined with Bref runtimes.

Monitoring Recommendations

Add automated header-assertion tests in continuous integration to fail builds when required security headers are missing from responses.
Log the full response header set at the edge, for example through CloudFront or a WAF, and alert when a known duplicate header appears only once.
Track dependency updates for mnapoli/bref in software composition analysis tools and flag versions earlier than 2.1.13.

How to Mitigate CVE-2024-24753

Immediate Actions Required

Upgrade Bref to version 2.1.13 or later in every affected Lambda deployment.
Redeploy Lambda functions so the patched Bref runtime is active in production.
Re-run automated tests that validate response headers to confirm security directives now reach clients.

Patch Information

The fix landed in commit f834027aaf88b3885f4aa8edf6944ae920daf2dc and shipped in Bref 2.1.13. Details are available in the GitHub Security Advisory GHSA-99f9-gv72-fw9r. Update the Composer dependency and redeploy every serverless function that depends on Bref.

Workarounds

Consolidate duplicate headers in application code before returning the response, for example by joining multiple Content-Security-Policy values into a single header.
Migrate the API Gateway integration to the REST API (v1) format, which supports multi-value headers natively, until the upgrade is deployed.
Terminate responses through a CloudFront function or Lambda@Edge that re-injects the required security headers after Bref processing.

bash

# Upgrade Bref to the patched release and redeploy
composer require mnapoli/bref:^2.1.13
composer update mnapoli/bref
serverless deploy