Listen to this Post
The vulnerability exists in the `Parser.parse` method within the HTTP trailer parsing logic. After processing the final chunk of a chunked transfer-encoded request, the `parseTrailers` function is invoked. The parser incorrectly terminates upon finding a single LF (\n) character preceded by a CR (\r), mistaking it for the double CRLF (\r\n\r\n) sequence that marks the end of the headers. This occurs when a malformed trailer header line lacks a colon. The parser sets `complete=true` prematurely, leaving a remainder in the buffer. This leftover data is then misinterpreted by the server as a new, subsequent HTTP request, enabling request smuggling. The flaw allows an attacker to inject a hidden request that bypasses security controls on a front-end proxy.
Platform: http4s
Version: <0.23.34
Vulnerability: Request Smuggling
Severity: Critical
date: 2024-01-09
Prediction: 2024-01-23
What Undercode Say:
printf 'POST / HTTP/1.1\r\nHost: localhost\r\nTransfer-Encoding: chunked\r\n\r\n2\r\naa\r\n0\r\nTest: smuggling\r\na\r\nGET /admin HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 8080
} else if (current == lf && (idx > 0 && message(idx - 1) == cr)) {
complete = true
}
How Exploit:
Bypass proxy security
Poison web cache
Hijack user sessions
Protection from this CVE
Upgrade to v0.23.34
Filter trailer headers
Validate HTTP grammar
Impact:
Security control bypass
Cache poisoning
Targeted attacks
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
