CVE-2024-24753 json
Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2
published 2024-02-01 2 y ago modified 2026-09-10 1 mo ago also GHSA-99f9-gv72-fw9r , EUVD-2024-0590
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | bref/bref | <2.1.13 |
2.1.13 |
Affected products
- brefphp bref
Classification
- Weakness
-
- CWE-436 Interpretation Conflict
References
-
github.com
/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc
web, patch
-
github.com
/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-24753
advisory
-
github.com
/brefphp/bref
package
-
github.com
/brefphp/bref/blob/2.1.12/src/Event/Http/HttpResponse.php#L61-L90
web
Sources
- CVE List CVE-2024-24753
- GitHub Advisory GHSA-99f9-gv72-fw9r
- NVD CVE-2024-24753
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.