Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2021-43797
Summary
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty versions prior to version 4.1.71.Final, 5.0.0.Alpha1 and 5.0.0.Alpha2 skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- REQUIRED
- NONE
- NONE
- NONE
CWE-444 - HTTP Request Smuggling
Entities such as web servers, web caching proxies, and application firewalls could parse HTTP requests differently. When there are two or more such entities in the path of an HTTP request, an attacker can send a specially crafted HTTP request that is seen as two different sets of requests by the attacked devices, allowing the attacker to smuggle a request into one device without the other device being aware of it. Such a vulnerability can prove devastating, for it enables further attacks on the application, like web cache poisoning, session hijacking, cross-site scripting, security bypassing, and sensitive information exposure.
Advisory Timeline
- Published
