CVE-2024-6504 Overview
CVE-2024-6504 is a denial of service vulnerability in Rapid7 InsightVM Console versions below 6.6.260. An attacker with network access to the Console's port 443 can send repeated invalid REST requests to trigger an exception handling logging loop. This loop exhausts CPU resources, causing the Console to overload or crash. The issue is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling). Rapid7 fixed the flaw in version 6.6.261. There is no indication that attackers can leverage this vulnerability to escalate privileges, access unauthorized data, or gain control of protected resources.
Critical Impact
Unauthenticated network attackers can disable the InsightVM Console by flooding port 443 with malformed REST requests, disrupting vulnerability management operations.
Affected Products
- Rapid7 InsightVM Console versions below 6.6.260
- Fixed in Rapid7 InsightVM version 6.6.261
- Deployments exposing Console port 443 to untrusted networks
Discovery Timeline
- 2024-07-18 - CVE-2024-6504 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-6504
Vulnerability Analysis
The vulnerability resides in how the InsightVM Console handles invalid REST API requests on port 443. When the Console receives malformed requests, it enters exception handling routines that log the error. Under a rapid stream of invalid requests, this logging behavior becomes a runaway loop. The result is CPU exhaustion and eventual service degradation or crash.
The flaw affects the availability of the vulnerability management platform itself. Security teams relying on InsightVM for scanning, reporting, and remediation workflows lose visibility during an active attack. Confidentiality and integrity remain intact because no data access or code execution occurs.
Root Cause
The root cause is improper resource throttling in the REST request exception handler. The Console lacks rate limiting or backpressure controls on invalid request processing. Each invalid request generates logging work that scales linearly with attacker request volume, satisfying the [CWE-770] pattern.
Attack Vector
An attacker requires network reachability to the Console on TCP port 443. No authentication or user interaction is needed. The attacker sends a sustained burst of invalid REST requests, which forces the Console into a repeating exception logging loop. Attack complexity is low because no protocol-specific payload crafting is required beyond issuing malformed HTTPS requests.
See the Rapid7 InsightVM Release Notes for vendor technical details.
Detection Methods for CVE-2024-6504
Indicators of Compromise
- Sustained high CPU utilization on the InsightVM Console host without corresponding scan activity
- Rapid growth in Console exception or error log files
- Unresponsive Console web interface or REST API on port 443
- High-frequency inbound HTTPS connections from a single or small set of source IPs
Detection Strategies
- Baseline normal REST request rates to the Console and alert on statistical deviations
- Monitor Console application logs for repeated exception stack traces within short windows
- Track TCP connection counts and HTTPS request rates to port 443 at the network layer
- Correlate host CPU spikes with inbound request volume to distinguish attacks from legitimate load
Monitoring Recommendations
- Forward Console application and system logs to a centralized log platform for retention and alerting
- Enable network flow logging on segments hosting the InsightVM Console
- Configure alerts on Console service health and process CPU thresholds
How to Mitigate CVE-2024-6504
Immediate Actions Required
- Upgrade Rapid7 InsightVM Console to version 6.6.261 or later
- Restrict network access to Console port 443 to trusted management networks only
- Place the Console behind a reverse proxy or web application firewall capable of rate limiting
- Review Console availability and logs for signs of prior exploitation attempts
Patch Information
Rapid7 addressed CVE-2024-6504 in InsightVM version 6.6.261. Administrators should apply the update through the standard InsightVM update channel. Refer to the Rapid7 InsightVM Release Notes for upgrade procedures and verification steps.
Workarounds
- Enforce IP allowlisting on Console port 443 at the perimeter firewall or host firewall
- Deploy rate limiting for HTTPS requests to the Console via an upstream proxy
- Segment the Console into a dedicated management VLAN unreachable from user or internet-facing networks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
