Skip to main content

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVE-2022-41721

High
7.5/10

Summary

A request smuggling attack is possible when using 'MaxBytesHandler'. When using 'MaxBytesHandler', the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. This issue affects the packages golang.org/x/net and github.com/golang/net versions 0.0.0-20220524220425-1d687d428aca through v0.1.0.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-444 - HTTP Request Smuggling

Entities such as web servers, web caching proxies, and application firewalls could parse HTTP requests differently. When there are two or more such entities in the path of an HTTP request, an attacker can send a specially crafted HTTP request that is seen as two different sets of requests by the attacked devices, allowing the attacker to smuggle a request into one device without the other device being aware of it. Such a vulnerability can prove devastating, for it enables further attacks on the application, like web cache poisoning, session hijacking, cross-site scripting, security bypassing, and sensitive information exposure.

References

Advisory Timeline

  • Published