blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.23.18, 1.0.0-M42
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- http4s blaze
fixed in 0.23.18; From 1.0.0-M1 · fixed in 1.0.0-M42
- org.http4s blaze-http_2.13
fixed in 0.23.18; From 1.0.0-M1 · fixed in 1.0.0-M42
- org.http4s blaze-http_3
fixed in 0.23.18; From 1.0.0-M1 · fixed in 1.0.0-M42
- org.http4s http4s-blaze-server_2.13
fixed in 0.23.18
- org.http4s:http4s-blaze-server_2.13Maven
fixed in 0.23.18
- org.http4s:blaze-http_2.13Maven
fixed in 0.23.18
- org.http4s:blaze-http_3Maven
fixed in 0.23.18
- org.http4s:blaze-http_3Maven
From 1.0.0-M1 · fixed in 1.0.0-M42
- org.http4s:blaze-http_2.13Maven
From 1.0.0-M1 · fixed in 1.0.0-M42