CVE-2024-22087
Published: 05 January 2024
Summary
CVE-2024-22087 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Alekseykurepin Pico Http Server In C. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Pico HTTP Server in C through commit f3b69a6 contains a stack-based buffer overflow in the route function within main.c. The flaw stems from an unbounded sprintf call that processes incoming URIs without length validation, enabling memory corruption. The vulnerability is tracked as CVE-2024-22087 and carries a CVSS 3.1 score of 9.8.
An unauthenticated remote attacker can trigger the issue by supplying an excessively long URI in an HTTP request. Successful exploitation grants arbitrary code execution on the server with no user interaction or privileges required, owing to the network-accessible attack vector and lack of bounds checking.
Public commits on the upstream repository address the problem by replacing the unsafe sprintf usage; the referenced patches are available at the listed GitHub URLs, and the associated issue thread documents the discovery and remediation steps. The EPSS score has remained steady at 0.1472 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19684
Vulnerability details
route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2024-22087 is a stack-based buffer overflow in Pico HTTP Server exploitable remotely via a long URI in HTTP GET requests, leading to remote code execution on public-facing web servers.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.