7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-4027

CVE-2024-4027: Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names

A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-4027

CVE-2024-4027:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.undertow:undertow-core	maven	< 2.2.39.Final	2.2.39.Final
io.undertow:undertow-core	maven	= 2.4.0.Alpha1	2.4.0.Beta1
io.undertow:undertow-core	maven	>= 2.3.0.Alpha1, < 2.3.21.Final	2.3.21.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2024-4027, is a denial-of-service in Undertow caused by an OutOfMemoryError when processing requests with large parameter names. The root cause is the absence of a default size limit on the request body, which is parsed when a servlet application calls HttpServletRequest.getParameterNames().

The analysis of the provided patch commit 6b7c18481ce65ae4012d92fe2b7f17a21ef4d70b reveals that the fix involves introducing a default 2MB limit for the request entity size (DEFAULT_MAX_ENTITY_SIZE) and multipart entity size (DEFAULT_MULTIPART_MAX_ENTITY_SIZE) in UndertowOptions.java.

This limit is then applied in the multipart parsing logic. Specifically, the function io.undertow.server.handlers.form.MultiPartParserDefinition.exchangeEvent was modified to use this new default limit when setting the maximum entity size for a multipart request. This prevents the server from processing excessively large multipart bodies.

While the patch does not modify io.undertow.servlet.spec.HttpServletRequestImpl.getParameterNames, the vulnerability description clearly identifies it as the trigger. An application developer would use this method, which in turn would invoke the vulnerable underlying parsing logic. Therefore, getParameterNames is a key indicator that would appear in a stack trace during exploitation.

In summary, the identified vulnerable functions are:

io.undertow.server.handlers.form.MultiPartParserDefinition.exchangeEvent: A function directly modified by the patch to enforce size limits, making it a concrete indicator of the fix and the vulnerable path.
io.undertow.servlet.spec.HttpServletRequestImpl.getParameterNames: The API method that initiates the vulnerable process, as highlighted in the CVE description.

Vulnerable functions

io.undertow.server.handlers.form.MultiPartParserDefinition.exchangeEvent

core/src/main/java/io/undertow/server/handlers/form/MultiPartParserDefinition.java

This function is part of the multipart request processing logic. The patch modifies it to enforce a default maximum entity size for multipart requests. Previously, no default limit was applied, allowing a large request body to be processed, leading to a potential OutOfMemoryError when parsing parameters. This function would be in the call stack when a multipart request is processed, which is one of the ways to trigger the vulnerability.

io.undertow.servlet.spec.HttpServletRequestImpl.getParameterNames

servlet/src/main/java/io/undertow/servlet/spec/HttpServletRequestImpl.java

This is the primary function that, when called by a servlet, triggers the vulnerability. It initiates the parsing of request parameters. Before the patch, calling this method on a request with an excessively large body (containing large parameter names) would cause the underlying parsing mechanism to consume a large amount of memory, leading to an OutOfMemoryError and a denial of service. While this function itself was not modified in the provided patch, it is the entry point for the vulnerable operation. The patch mitigates the issue by imposing a size limit on the request body before it is parsed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.