CVE-2024-24762

Regular expression denial of service in `python-multipart` parser.

• CVSS 7.5
• CWE-1333
• Resource Management
• Remote

`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.

CVE

CVE-2024-24762

CWE

CWE-1333

CVSS base score

7.5

Published

2024-02-05

OWASP

A03 Injection

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

python-multi

Fixed by upgrading

Yes

Solution

Upgrade to `python-multipart` version 0.0.7 or later.

from multipart import MultipartParser

def handle_request(environ):
    content_type = environ.get('CONTENT_TYPE', '')
    body = environ['wsgi.input'].read()
    
    parser = MultipartParser(body, content_type)

from multipart import MultipartParser
from io import BytesIO

MAX_BODY_SIZE = 10 * 1024 * 1024

def handle_request(environ):
    content_type = environ.get('CONTENT_TYPE', '')
    if not content_type.startswith('multipart/form-data'):
        raise ValueError("Invalid Content-Type")

    body = environ['wsgi.input'].read(MAX_BODY_SIZE + 1)
    if len(body) > MAX_BODY_SIZE:
        raise ValueError("Request body too large")

    try:
        parser = MultipartParser(BytesIO(body), content_type)
    except Exception as e:
        raise ValueError(f"Failed to parse multipart data: {str(e)}")

Content-Type: multipart/form-data; boundary=------------------------abcdefg; option=very_complex_option_with_repeated_patterns_and_special_characters_(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((

@misc{vaitp:cve202424762,
  title        = {{Regular expression denial of service in `python-multipart` parser.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-24762},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-24762/}}
}