CVE-2017-8807

What it actually does

The flaw in vbf_stp_error allows a VFP_GetStorage buffer to exceed intended size when using -sfile Stevedore transient objects, resulting in out-of-bounds memory access that leaks sensitive process memory contents to remote clients.

Why it matters to the business

Organizations running affected Varnish versions risk exposure of internal memory contents such as session tokens, cached responses, or configuration data to unauthenticated remote attackers, increasing breach likelihood and compliance exposure; the issue affects widely deployed caching layers in web ecosystems with high downstream dependents.

How an attack unfolds

An attacker sends specially crafted HTTP requests that trigger the buffer sizing error during fetch processing with file-based stevedore storage; the oversized buffer returns adjacent memory regions containing sensitive data in the response, enabling information disclosure without authentication or user interaction.

How to fix it

Upgrade Varnish Cache to 4.1.9 or 5.2.1 or later; apply the specific commits 5024f60c3a51f537279977989b645e983a946e1a or 176f8a075a963ffbfa56f1c460c15f6a1a6af5a7; for WordPress and TYPO3 deployments update to versions incorporating 131440c1a5f0e1e2273f7c2fff2533b94c77c30d or 8.7.40 respectively; disable -sfile stevedore if immediate upgrade is impossible.

How to confirm the fix worked

Verify installed Varnish version against fixed releases; review cache configuration for -sfile usage; test with crafted requests to confirm absence of memory leakage in responses; monitor vendor changelogs for backports.

Typical attack path

1. Identify publicly reachable Varnish instances via banner grabbing or traffic analysis
2. Craft and send HTTP requests designed to exercise the fetch path with -sfile stevedore objects
3. Receive oversized responses containing leaked process memory
4. Parse leaked data for credentials, tokens, or other sensitive artifacts for further attacks

How to detect it

Review Varnish access and error logs for anomalous response sizes or repeated requests targeting fetch paths; inspect cache hit patterns for unexpected data volumes; correlate with network captures showing oversized responses from Varnish processes.

What your security team should do

• Prioritize immediate upgrade of all Varnish instances to patched versions given the high CVSS and memory disclosure nature
• Audit configurations to replace -sfile stevedore with safer storage backends where possible
• Implement network segmentation and WAF rules to limit exposure of caching layers
• Schedule periodic version scanning across the web infrastructure estate