Request smuggling via multiple Transfer-Encoding acceptance
Published Feb 17, 2021 · Updated Sep 16, 2024
HTTP request smuggling in Lightbend Akka HTTP before 10.1.14 and 10.2.0 through 10.2.3 allows remote attackers to bypass proxy inspection. The HTTP message parser accepts multiple Transfer-Encoding values, ignores that header, and uses Content-Length to delimit and forward the request unchanged. Exploitation requires an application acting as a reverse proxy and a backend that parses the malformed request as two messages, allowing the second to reach the backend without proxy inspection.
Summary
What happened
HTTP request smuggling in Lightbend Akka HTTP before 10.1.14 and 10.2.0 through 10.2.3 allows remote attackers to bypass proxy inspection. The HTTP message parser accepts multiple Transfer-Encoding values, ignores that header, and uses Content-Length to delimit and forward the request unchanged. Exploitation requires an application acting as a reverse proxy and a backend that parses the malformed request as two messages, allowing the second to reach the backend without proxy inspection.
The record
- CVE
- CVE-2021-23339
- Published
- Feb 17, 2021
- Updated
- Sep 16, 2024
- Vendor
- Lightbend
- Product
- Akka HTTP
- Classifications
- CWE-444, T1190
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Feb 17, 2021CVE publishedPublication date reported by the CVE source.
- Sep 16, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=all versions before 10.1.14 and from 10.2.0 to 10.2.4
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo