CVE-2024-24754
Description
Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the $files or $parsedBody arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
bref/brefPackagist | < 2.1.13 | 2.1.13 |
Affected products
3- brefphp/brefv5Range: < 2.1.13
Patches
Vulnerability mechanics
References
5- github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092nvdPatchWEB
- github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8wnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-82vx-mm6r-gg8wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-24754ghsaADVISORY
- github.com/brefphp/bref/blob/2.1.12/src/Event/Http/Psr7Bridge.phpghsaWEB
News mentions
0No linked articles in our index yet.