Listen to this Post
The vulnerability exists in the `readRawBody` function of h3 v1.15.4. It performs a case-sensitive string comparison when checking the `Transfer-Encoding` header for the value “chunked”. According to RFC 7230, HTTP header values are case-insensitive. When a request with a mixed-case header like `Transfer-Encoding: ChuNked` is processed, and no `Content-Length` header is present, the function fails to identify the chunked encoding. This causes the server to incorrectly assume the request body is empty and immediately process the request, leaving the actual body data on the TCP socket. If the h3 application is behind a proxy or load balancer (like AWS NLB) that does not normalize this header, it creates a desynchronization (TE.TE smuggling). The backend’s interpretation of the request boundaries diverges from the proxy’s, allowing an attacker to prepend a smuggled request to the next legitimate user’s connection.
Platform: h3
Version: v1.15.4
Vulnerability: HTTP Request Smuggling
Severity: Critical
date: 2024-10-15
Prediction: Patch released v1.15.5
What Undercode Say:
curl -X POST http://target/ -H "Transfer-Encoding: ChunKed" -d "1\r\nX\r\n"
// Vulnerable check in src/utils/body.ts
.includes("chunked") // Case-sensitive
// Fixed check
.includes("chunked".toLowerCase())
How Exploit:
Send mixed-case `Transfer-Encoding` header with a smuggled request body. Proxy sees one request, backend sees two.
Protection from this CVE
Update to h3 >=1.15.5. Implement header normalization in reverse proxies.
Impact:
Request smuggling, WAF bypass, cache poisoning, session hijacking.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
