CVE-2024-47554

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC and 1 lab environment to CVE-2024-47554.

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 3, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Apache Commons IO

Browse Apache Software Foundation / Apache Commons IOcommons-io:commons-io

Default status: unaffected

CVE List2.0 to < 2.14.0affected

commons-io:commons-io

Browse Maven / commons-io:commons-io
GitHub Advisory2.0 to < 2.14.0 · Fixed in 2.14.0affected

Proofs of concept

1

Repository PoCs

GitHubPawelMurdzek/CVE-2024-38355-PoCRepository PoCby PawelMurdzek0Exploit9 files

11.3 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Node.js exploit client that sends a crafted Socket.IO packet to trigger an uncaught exception on a vulnerable server, causing a denial-of-service crash. It includes a vulnerable server for demonstration and a step-by-step exploit script that verifies the server is no longer reachable after the attack.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and an exploit script for CVE-2024-38355. The exploit script connects to a target server, sends a normal message, then sends a crafted payload to trigger a server crash, and finally checks if the server is unreachable. This behavior is consistent with a proof-of-concept denial-of-service demonstration and does not exhibit any backdoor, concealed operator-directed harm, or unrelated payload.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesJavaScriptMarkdown
Target softwaresocket.io
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The exploit/exploit.js file contains code that actively sends a malicious payload to crash a target server, which is the definition of an exploit. The README describes it as a 'Proof of Concept' and the code includes steps to verify the server crash, confirming its purpose is to exercise the vulnerability.

exploit/exploit.js:43-47README.md:3README.md:28-29

Requirements

  • A running Socket.IO server with a vulnerable version (<2.5.1 or >=3.0.0,<4.6.2) and an event handler that throws an uncaught exception on receiving specific data.README.md:7-9README.md:114-122
  • Network access to the target server.exploit/exploit.js:3

Observed behavior

  • Connects to the target Socket.IO server and sends a normal 'process_data' event to confirm connectivity.exploit/exploit.js:11-17
  • Sends a malicious 'process_data' event with a payload ({ trigger: 'crash' }) designed to cause an uncaught exception on the server.exploit/exploit.js:40-47
  • Attempts to reconnect to the server to verify it has crashed and is no longer reachable.exploit/exploit.js:61-86
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the core PoC action for CVE-2024-38355, demonstrating the uncaught exception crash.exploit/exploit.js:47
Target Connection
Payload withheldThe target is configurable via environment variable, defaulting to localhost:3000. No hardcoded external C2 or data exfiltration endpoint is present.exploit/exploit.js:3
Review boundaries

What the analysis did not establish

  • Only two of nine text files were included in the evidence packet; the vulnerable server code (server/index.js) and other project files were omitted.
  • The evidence packet metadata indicates 7 unclassified files totaling 3710 bytes were not analyzed.
  • Only two text files (README.md and exploit/exploit.js) were included in the evidence; 7 other files in the repository were omitted from the text content. The metadata indicates these are likely configuration files (e.g., package.json, Dockerfile) and a server script, but their content was not reviewed.
  • Binary files were not analyzed; the evidence policy flagged them as metadata-only, but no binary files were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

PawelMurdzek/CVE-2024-38355-PoCCreated Vuln labCVE-2024-38355CVE-2024-47554Compose · builds

1 Compose manifest · 2 Dockerfiles · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment with two services: a vulnerable Socket.IO server and an exploit client that demonstrates a denial-of-service crash.

docker-compose.yml:1-24README.md:1-5

Lab assessment

Vulnerability lab

The README explicitly states this is a Proof of Concept for CVE-2024-38355, a Socket.IO DoS vulnerability. The server code contains a deliberate uncaught exception, and the exploit client sends a payload to trigger it.

README.md:1-5server/index.js:14-24exploit/exploit.js:1-5
Lab shapeCompose · builds
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable-server

vulnerable targetSocket.IO server

A Node.js server using socket.io@4.6.1 that listens on port 3000. It has a 'process_data' event handler that throws an uncaught exception when receiving {trigger:'crash'}, demonstrating the CVE-2024-38355 vulnerability.

server/index.js:1-40server/package.json:1-12server/Dockerfile:1-12

exploit-client

exploit runnerproof-of-concept client

A Node.js script that connects to the vulnerable server, sends a normal request, then sends a malicious payload ({trigger:'crash'}) to crash the server, and finally verifies the server is unreachable.

exploit/exploit.js:1-87exploit/package.json:1-13exploit/Dockerfile:1-10
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-38355

Supported by supplied evidence

The server uses socket.io@4.6.1 (vulnerable per README), lacks an error handler on the socket, and throws an uncaught exception when processing a specific client payload, matching the described DoS mechanism.

server/package.json:10server/index.js:14-24README.md:7-15

CVE-2024-47554

Insufficient evidence

No evidence in the supplied files references CVE-2024-47554. The README, code, and manifests only mention CVE-2024-38355. The repository alias includes this CVE, but no content supports it.

Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed, or Node.js 18+ with npm.README.md:33-37
  • The vulnerable server must be running and reachable by the exploit client (handled by Docker Compose networking).docker-compose.yml:8-16

Evidence-described exercise path

  1. Build and start the environment with 'docker-compose up' (or run server and exploit manually).README.md:41-48
  2. The exploit client connects to the server, sends a normal 'process_data' event, and verifies a successful response.exploit/exploit.js:9-27
  3. The exploit client sends a malicious payload ({trigger:'crash'}) to the server, causing an uncaught exception and crashing the Node.js process.exploit/exploit.js:30-50
  4. The exploit client attempts to reconnect and verifies the server is unreachable, confirming the crash.exploit/exploit.js:53-80
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All behavior is confined to the lab's internal Docker network. The exploit only sends a crash payload to the vulnerable server and checks connectivity; it does not access the host, external systems, or perform any destructive actions beyond the intended DoS demonstration.

docker-compose.yml:8-16exploit/exploit.js:1-87server/index.js:1-40
Review boundaries

What the analysis did not establish

  • CVE-2024-47554 is present in repository aliases but has no supporting evidence in the supplied files.
  • The LICENSE file is not included in evidence_files, but its content is not required for this analysis.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

5