CVE-2024-9437: Superagi Superagi DoS Vulnerability

CVE-2024-9437 Overview

CVE-2024-9437 is an unauthenticated denial of service (DoS) vulnerability in SuperAGI version 0.0.14. The flaw exists in the resource upload endpoint, where appending characters such as dashes to the multipart boundary in an HTTP request forces the server to process each character continuously. This behavior triggers excessive resource consumption and renders the service unavailable. Attackers can exploit the issue over the network without authentication or user interaction. The vulnerability is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Remote unauthenticated attackers can exhaust server resources with a single crafted multipart HTTP request, taking the SuperAGI service offline for all users.

Affected Products

SuperAGI 0.0.14
SuperAGI resource upload endpoint (multipart handler)
Deployments exposing the SuperAGI HTTP API to untrusted networks

Discovery Timeline

2025-03-20 - CVE-2024-9437 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9437

Vulnerability Analysis

The vulnerability resides in the multipart form handler used by SuperAGI's resource upload request. HTTP multipart requests separate parts using a boundary string declared in the Content-Type header. SuperAGI's parser does not enforce an upper bound on how many trailing characters, such as dashes, it will process when scanning for the boundary terminator. Sending a boundary padded with a large number of appended characters causes the parser to iterate over each character, consuming CPU and memory. The endpoint is reachable without authentication, so any network-adjacent attacker can trigger the condition. Repeated requests amplify the effect and prevent legitimate users from accessing the service.

Root Cause

The root cause is missing input validation and absent resource limits during multipart boundary parsing. The handler accepts arbitrarily long boundary variants and continues processing each character instead of rejecting malformed input. This falls under [CWE-770], where the application allocates processing cycles without throttling or bounding the workload.

Attack Vector

Exploitation requires only a single HTTP POST request to the resource upload endpoint. The attacker sets a Content-Type: multipart/form-data header with a boundary value followed by an extended sequence of dashes or filler characters. The server begins scanning the request body and loops through each character while attempting to match the boundary. No credentials, tokens, or user interaction are needed. Detailed exploitation notes are available in the Huntr Bounty Details.

No verified public exploit code is available. The vulnerability mechanism can be reproduced by sending a multipart/form-data POST request in which the declared boundary value is followed by a large volume of appended dash characters, forcing the server-side parser into an extended processing loop.

Detection Methods for CVE-2024-9437

Indicators of Compromise

Sudden spikes in CPU or memory consumption on the SuperAGI application host correlating with inbound HTTP POST traffic.
Multipart HTTP requests to SuperAGI upload endpoints containing abnormally long boundary strings or extended trailing dash sequences.
Increased latency or timeouts on the SuperAGI API followed by service unavailability for legitimate users.

Detection Strategies

Inspect web server or reverse proxy logs for Content-Type headers with unusually long boundary values directed at SuperAGI endpoints.
Deploy web application firewall (WAF) rules that flag multipart boundaries exceeding reasonable length thresholds (for example, over 128 characters).
Correlate application performance metrics with request logs to identify single-source request patterns that precede resource exhaustion.

Monitoring Recommendations

Alert on sustained high CPU utilization by the SuperAGI process combined with elevated request rates from a single client IP.
Track HTTP 5xx error rates and request duration percentiles on the resource upload endpoint to catch degraded performance early.
Log and review all unauthenticated POST requests to /resources or equivalent upload paths for volumetric anomalies.

How to Mitigate CVE-2024-9437

Immediate Actions Required

Upgrade SuperAGI beyond version 0.0.14 once a fixed release is available from the vendor.
Restrict network access to the SuperAGI API using firewall rules, VPN, or authenticated reverse proxies until a patch is applied.
Place a WAF or reverse proxy in front of SuperAGI to validate multipart boundary length and reject oversized headers.

Patch Information

No vendor advisory or official patch URL is referenced in the NVD entry. Consult the Huntr Bounty Details and the SuperAGI project repository for the latest remediation guidance and upgrade instructions.

Workarounds

Enforce a maximum request header size and maximum boundary length at the reverse proxy layer (for example, NGINX large_client_header_buffers and client_max_body_size).
Apply per-client rate limiting and connection timeouts to reduce the impact of repeated malicious upload attempts.
Disable or gate the resource upload endpoint behind authentication if it is not required for public use.

bash

# Example NGINX reverse proxy hardening in front of SuperAGI
http {
    client_max_body_size 10m;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 8k;
    client_body_timeout 10s;
    client_header_timeout 10s;

    limit_req_zone $binary_remote_addr zone=superagi_up:10m rate=5r/s;

    server {
        listen 443 ssl;
        server_name superagi.example.com;

        location /resources {
            limit_req zone=superagi_up burst=10 nodelay;
            proxy_pass http://127.0.0.1:8000;
        }
    }
}