CVE-2020-7238: HTTP Request Smuggling in Netty
Summary
CVE-2020-7238: HTTP Request Smuggling in Netty. Affects io.netty:netty-handler versions >= 4.1.43, < 4.1.45. Fixed in 4.1.45. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2020-7238 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular Java framework for building high-performance network applications. It provides an event-driven architecture and a set of reusable components for developing scalable and efficient network protocols. The 'netty-handler' package is a core component of Netty that handles various network protocols, including HTTP. This vulnerability affects versions 4.1.43 to 4.1.44 of the 'netty-handler' package.
Vulnerability Detail
The vulnerability in Netty 4.1.43.Final is related to HTTP Request Smuggling. It occurs due to mishandling of Transfer-Encoding whitespace and a later Content-Length header. Attackers can exploit this vulnerability to manipulate the HTTP request/response flow, potentially leading to various security issues such as cache poisoning, session hijacking, or bypassing security controls. This vulnerability was initially reported as CVE-2019-16869, and the fix provided in Netty 4.1.45 is incomplete.
How To Fix
Minimum fixed version
4.1.45
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround is to implement a custom request/response parser that correctly handles Transfer-Encoding and Content-Length headers. Here's an example of a workaround in Java:
// Custom request/response parser
public class CustomParser {
public static HttpRequest parseRequest(String rawRequest) {
// Implement parsing logic here
}
public static HttpResponse parseResponse(String rawResponse) {
// Implement parsing logic here
}
}
Replace the default Netty request/response parser with this custom parser to mitigate the vulnerability until the package can be upgraded.
Conclusion
The HTTP Request Smuggling vulnerability in Netty 4.1.43.Final can be mitigated by upgrading to version 4.1.45 or later of the 'netty-handler' package. If immediate upgrade is not possible, a temporary workaround is to implement a custom request/response parser. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.netty:netty-handler →
FAQ
Netty is a Java framework for building high-performance network applications. It provides an event-driven architecture and reusable components for developing scalable and efficient network protocols.
HTTP Request Smuggling is a technique where an attacker manipulates the HTTP request/response flow to bypass security controls, perform cache poisoning, or hijack sessions.
Exploiting this vulnerability can lead to security issues such as cache poisoning, session hijacking, or bypassing security controls.
To fix this vulnerability, upgrade the 'netty-handler' package to version 4.1.45 or later.
Yes, you can implement a custom request/response parser that correctly handles Transfer-Encoding and Content-Length headers as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-handler.
