CVE-2024-29186: Mnapoli Bref DOS Vulnerability

CVE-2024-29186 Overview

CVE-2024-29186 is a denial of service vulnerability in Bref, an open-source framework that runs PHP applications on AWS Lambda. Versions prior to 2.1.17 are affected when Bref uses the Event-Driven Function runtime with a RequestHandlerInterface handler. An attacker can send crafted multipart POST requests that force the server to perform expensive multi-byte string operations. The result is increased Lambda billed duration and potential resource exhaustion [CWE-400]. The maintainers released a fix in version 2.1.17.

Critical Impact
Attackers can inflate AWS Lambda billed duration to more than 900ms per request on default 1024MB configurations running PHP <= 8.2, driving up cloud costs and degrading service availability.

Affected Products

Bref versions prior to 2.1.17
Bref deployments using the Event-Driven Function runtime with RequestHandlerInterface handlers
Bref Lambda functions accepting POST requests, particularly those on PHP runtimes <= php-82

Discovery Timeline

2024-03-22 - CVE-2024-29186 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29186

Vulnerability Analysis

Bref converts incoming Lambda events into PSR-7 request objects before dispatching them to the application handler. When the incoming request is a multipart body, each part is parsed using the Riverline/multipart-parser library. The parser handles per-part Content-Type headers through StreamedPart::parseHeaderContent, which invokes mb_convert_encoding with attacker-controlled $string and $from_encoding parameters. Crafted header values force the function into slow multi-byte conversion paths, consuming CPU time proportional to the input size. Because AWS Lambda bills for execution duration, this translates directly into inflated compute costs and reduced concurrency for legitimate requests.

Root Cause

The root cause is unbounded algorithmic complexity in header parsing. The Riverline/multipart-parser library trusted attacker-supplied encoding values passed to mb_convert_encoding without validation or length limits. Bref inherited this behavior when converting Lambda events into PSR-7 objects.

Attack Vector

An unauthenticated attacker sends POST requests of up to 6MB containing crafted multipart bodies to a Bref-hosted endpoint. Each request forces the Lambda to spend hundreds of milliseconds parsing malicious Content-Type headers. The 10KB request header size limit does not mitigate the issue because the malicious content resides in the request body. On default 1024MB Lambda images with PHP <= 8.2, a single request can consume over 900ms of billed duration.

text

// Patch: composer.json dependency bump requiring the fixed parser version
         "psr/container": "^1.0|^2.0",
         "psr/http-message": "^1.0|^2.0",
         "psr/http-server-handler": "^1.0",
-        "riverline/multipart-parser": "^2.0.6",
+        "riverline/multipart-parser": "^2.1.2",
         "symfony/process": "^4.4|^5.0|^6.0|^7.0"
     },
     "require-dev": {

Source: Bref security patch commit 5f7c029

Detection Methods for CVE-2024-29186

Indicators of Compromise

Repeated POST requests with unusually large multipart bodies approaching the 6MB payload limit
Multipart Content-Type headers containing unusual character-set or encoding parameter values
Sustained Lambda invocations reporting billed durations between 400ms and 900ms for endpoints that normally return quickly
Sudden increases in AWS Lambda cost or concurrency utilization without corresponding legitimate traffic growth

Detection Strategies

Instrument Lambda handlers to log request size, Content-Type header contents, and processing duration for outlier analysis
Enable AWS CloudWatch metric alarms on Duration and ConcurrentExecutions for endpoints backed by Bref RequestHandlerInterface handlers
Deploy an AWS Web Application Firewall (WAF) rule that inspects multipart request bodies for malformed encoding parameters and abnormal length

Monitoring Recommendations

Track per-endpoint billed duration percentiles and alert when the p95 diverges from baseline
Correlate spikes in Lambda cost with source IP distribution to identify concentrated abuse
Retain multipart request metadata in a centralized log platform to support post-incident forensics

How to Mitigate CVE-2024-29186

Immediate Actions Required

Upgrade Bref to version 2.1.17 or later in every affected Lambda function
Verify that the resolved riverline/multipart-parser dependency is 2.1.2 or newer using composer show
Redeploy all Lambda functions using the Event-Driven Function runtime with RequestHandlerInterface handlers
Review AWS billing dashboards for cost anomalies dating back to the vulnerable deployment window

Patch Information

Bref 2.1.17 contains the fix, applied via the security patch commit 5f7c029 which bumps the riverline/multipart-parser dependency to ^2.1.2. Details of the disclosure are documented in the GitHub Security Advisory GHSA-j4hq-f63x-f39r.

Workarounds

Place an AWS WAF or API Gateway rule in front of vulnerable Lambdas to reject POST requests exceeding a strict size threshold below 6MB
Configure Lambda function timeouts and concurrency limits to cap the maximum billable impact of a single abusive request
Where feasible, migrate endpoints off RequestHandlerInterface handlers until the upgrade is deployed

bash

# Upgrade Bref to the patched release and refresh the lock file
composer require bref/bref:^2.1.17
composer update bref/bref riverline/multipart-parser
composer show riverline/multipart-parser | grep versions