Every CVE Search/ Get API key

CVE-2024-24753

Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2

4.8 MediumFix available

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.43%Up 0.4 points since Feb 8, 2024
90%50%10%1%

What each source reports

CVE List Score used 4.8

Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Record
CVE-2024-24753
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-436
Updated
2026-11-02
EUVDEUVD-2024-0590 4.8

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Record
EUVD-2024-0590
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-99f9-gv72-fw9r 4.8

Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2

Impacted Resources

bref/src/Event/Http/HttpResponse.php:61-90

Description

When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers.

Precisely, if PHP generates a response with two headers having the same key but different values only the latest one is kept.

Impact

If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security.

For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one.

PoC

  1. Create a new Bref project.
  2. Create an index.php file with the following content:
<?php
header("Content-Security-Policy: script-src 'none'", false);
header("Content-Security-Policy: img-src 'self'", false);
?>
<script>alert(document.domain)</script>
<img src="https://bref.sh/favicon-32x32.png">
  1. Use the following serverless.yml to deploy the Lambda:
service: app

provider:
    name: aws
    region: eu-central-1

plugins:
    - ./vendor/bref/bref

functions:
    api:
        handler: index.php
        description: ''
        runtime: php-81-fpm
        timeout: 28 # in seconds (API Gateway has a timeout of 29 seconds)
        events:
            -   httpApi: '*'

# Exclude files from deployment
package:
    patterns:
        - '!node_modules/**'
        - '!tests/**'
  1. Browse the Lambda URL.
  2. Notice that the JavaScript code is executed as the Content-Security-Policy: script-src 'none' header has been removed.
  3. Notice that the external image has not been loaded as the Content-Security-Policy: img-src 'self' header has been kept.
  4. Start a PHP server inside the project directory (e.g. php -S 127.0.0.1:8090).
  5. Browse the index.php script through the PHP server (e.g. http://127.0.0.1:8090/index.php).
  6. Notice that the JavaScript code is not executed as the Content-Security-Policy: script-src 'none' header has been kept.
  7. Notice that the external image has not been loaded as the Content-Security-Policy: img-src 'self' header has been kept.

Suggested Remediation

Concatenate all the multiple value headers' values with a comma (,) as separator and return a single header with all the values to the API Gateway.

References

Record
GHSA-99f9-gv72-fw9r
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-436
Updated
2026-11-02
NVD 4.8

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Record
CVE-2024-24753
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-436
Updated
2026-11-02
OSV 4.8

Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Record
CVE-2024-24753
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-436
Updated
2026-11-02
OSVGHSA-99f9-gv72-fw9r 4.8

Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2

Impacted Resources

bref/src/Event/Http/HttpResponse.php:61-90

Description

When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers.

Precisely, if PHP generates a response with two headers having the same key but different values only the latest one is kept.

Impact

If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security.

For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one.

PoC

  1. Create a new Bref project.
  2. Create an index.php file with the following content:
<?php
header("Content-Security-Policy: script-src 'none'", false);
header("Content-Security-Policy: img-src 'self'", false);
?>
<script>alert(document.domain)</script>
<img src="https://bref.sh/favicon-32x32.png">
  1. Use the following serverless.yml to deploy the Lambda:
service: app

provider:
    name: aws
    region: eu-central-1

plugins:
    - ./vendor/bref/bref

functions:
    api:
        handler: index.php
        description: ''
        runtime: php-81-fpm
        timeout: 28 # in seconds (API Gateway has a timeout of 29 seconds)
        events:
            -   httpApi: '*'

# Exclude files from deployment
package:
    patterns:
        - '!node_modules/**'
        - '!tests/**'
  1. Browse the Lambda URL.
  2. Notice that the JavaScript code is executed as the Content-Security-Policy: script-src 'none' header has been removed.
  3. Notice that the external image has not been loaded as the Content-Security-Policy: img-src 'self' header has been kept.
  4. Start a PHP server inside the project directory (e.g. php -S 127.0.0.1:8090).
  5. Browse the index.php script through the PHP server (e.g. http://127.0.0.1:8090/index.php).
  6. Notice that the JavaScript code is not executed as the Content-Security-Policy: script-src 'none' header has been kept.
  7. Notice that the external image has not been loaded as the Content-Security-Policy: img-src 'self' header has been kept.

Suggested Remediation

Concatenate all the multiple value headers' values with a comma (,) as separator and return a single header with all the values to the API Gateway.

References

Record
GHSA-99f9-gv72-fw9r
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-436
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bref/bref
Packagist
 before 2.1.13
2.1.13
bref/bref
Packagist
 before 2.1.13, plus listed versions
0.1.00.2.00.2.10.2.100.2.11
Show 45 moreShow less
0.2.120.2.130.2.140.2.150.2.160.2.170.2.180.2.190.2.20.2.200.2.210.2.220.2.230.2.240.2.250.2.260.2.270.2.280.2.290.2.30.2.300.2.310.2.320.2.330.2.340.2.350.2.360.2.370.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.70.3.80.3.90.4.0
2.1.13

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-24753 is a medium vulnerability (CVSS 4.8) in Brefphp Bref, published February 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in bref/bref 2.1.13.

References

This page doesn't list everything

Left out here: 174 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open