Read the docs
TI-2024-16271 Aliases CVE-2024-24754GHSA-82vx-mm6r-gg8w

Bref Body Parsing Inconsistency in Event-Driven Functions

Priority HIGH 75CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the `$files` or `$parsedBody` arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00618 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed bref (brefphp): 2.1.13bref/bref (Packagist): 2.1.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
brefphpbrefbefore 2.1.132.1.13Patch availableCNA
—bref/bref (Packagist)before 2.1.132.1.13Patch availableGHSA-82vx-mm6r-gg8w
  • bref Vendorbrefphp Affected before 2.1.13 Fixed in 2.1.13 Patch available CNA
  • bref/bref (Packagist) Vendor— Affected before 2.1.13 Fixed in 2.1.13 Patch available GHSA-82vx-mm6r-gg8w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mnapoli:bref:*:*:*:*:*:*:*:*before 2.1.13Vulnerablebrefphp
  • cpe:2.3:a:mnapoli:bref:*:*:*:*:*:*:*:* Versions before 2.1.13 Vulnerable ·brefphp

Remediation

  • Fix · CNA bref (brefphp) Fixed in 2.1.13
  • Fix · GHSA-82vx-mm6r-gg8w bref/bref (Packagist) Fixed in 2.1.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24754
  2. 2026-10-03 Alias added: GHSA-82vx-mm6r-gg8w

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2024-16270 Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2 CVSS 3.1MEDIUM 6.5
  • TI-2024-16269 Bref Uploaded Files Not Deleted in Event-Driven Functions CVSS 3.1MEDIUM 6.5
  • TI-2024-19355 Slow String Operations via MultiPart Requests in Event-Driven Functions CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences