CVE-2024-38828 Vulnerability

Description

The test checks behavior/reaction in Spring Framework with and without the CVE-2024-38828 vulnerability. In ByteArrayHttpMessageConverter, memory is allocated in ByteArrayOutputStream based on the Content-Length request header, which may not match reality if the body is 0 bytes. With a sharp increase in such requests (DoS), memory is used suboptimally, regular GC cleanups occur, and the application starts lagging. I will show how to implement/fix this and the metrics.

Vulnerability Description

CVE-2024-38828 is a Denial of Service (DoS) vulnerability in Spring Framework that allows an attacker to cause memory exhaustion on the server via a Spring MVC controller with a byte[] parameter.

Technical Details

• Vulnerable Versions: Spring Framework 5.3.x (all versions)
• Vulnerability Type: Denial of Service (DoS)
• Attack Vector: HTTP POST requests with Content-Length = 2^31 - 1
• Impact: Server memory exhaustion leading to denial of service

Solution

Implemented Fix

1. Created a custom HttpMessageConverter for handling byte arrays
2. Implemented checking of incoming data size
3. Used a streaming approach for processing large payloads

Testing

Project Structure

.
├── src/
│   └── main/
│       └── java/
│           └── me/
│               └── func/
│                   └── demo/
│                       ├── config/
│                       │   └── WebConfig.java
│                       ├── converter/
│                       │   └── SafeByteArrayHttpMessageConverter.java
│                       ├── controller/
│                       │   └── DemoController.java
│                       └── DemoApplication.java
├── tests/
│   ├── load_test.py
│   └── results/
│       ├── результаты_теста.png
│       └── метрики.json
└── README.md

Test Parameters

• Number of requests: 6000
• Maximum concurrent requests: 5
• Delay between request groups: 0.1 seconds
• Request size: 1 byte
• Content-Length header: 2^31 - 1 (maximum value for int)

Test Code

def send_request(url):
    try:
        response = requests.post(
            url,
            data=b'0',  # Minimal payload
            headers={
                'Content-Type': 'application/octet-stream',
                'Content-Length': str(2**31 - 1)  # Maximum size
            }
        )
        return response.status_code, response.text
    except Exception as e:
        return f"Error: {str(e)}", None

Running Tests

1. Install Python dependencies:

pip install -r requirements.txt

2. Run the test:

python tests/load_test.py