CVE-2017-2666: Undertow-core vulnerable to HTTP Request Smuggling
Summary
CVE-2017-2666: Undertow-core vulnerable to HTTP Request Smuggling. Affects io.undertow:undertow-core across 2 version ranges.
< 1.3.31
>= 1.4.0, < 1.4.17
Fixed in 1.3.31 or 1.4.17, depending on the release line you run. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2017-2666 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a lightweight web server written in Java that is designed to be flexible and performant. It is commonly used in Java-based web applications to handle HTTP requests and responses. Undertow-core is a core component of the Undertow web server. It provides the foundational functionality for handling HTTP connections and processing HTTP requests and responses. Unfortunately, a vulnerability has been discovered in Undertow-core that allows for HTTP Request Smuggling attacks.
Vulnerability Detail
The vulnerability in Undertow-core arises from a flaw in the code responsible for parsing the HTTP request line. This flaw allows for the inclusion of invalid characters in the request line, which can be exploited in conjunction with a proxy that also permits these invalid characters but with a different interpretation. By manipulating the HTTP response, an attacker can inject data into the response, potentially leading to various attacks such as web-cache poisoning, cross-site scripting (XSS), or obtaining sensitive information from other requests. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.311.3.31 -
>= 1.4.0, < 1.4.171.4.17
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Undertow-core package is not immediately feasible, a temporary workaround is to configure the proxy server to reject requests containing invalid characters in the request line. This can be achieved by modifying the proxy server's configuration to include a validation step that checks for and rejects such requests. The specific steps to implement this workaround may vary depending on the proxy server being used.
Conclusion
Undertow-core is vulnerable to HTTP Request Smuggling, which can lead to various attacks and compromise the security of web applications. It is crucial to update the Undertow-core package to the recommended versions or implement the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
Undertow-core is a core component of the Undertow web server, providing the foundational functionality for handling HTTP connections and processing HTTP requests and responses.
HTTP Request Smuggling is a technique where an attacker manipulates the HTTP request and response to bypass security measures, inject malicious content, or obtain sensitive information.
The potential consequences of this vulnerability include web-cache poisoning, cross-site scripting (XSS) attacks, and the ability to obtain sensitive information from requests other than the attacker's own.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
