CVE-2021-20220: HTTP Request Smuggling in Undertow

Background

Undertow is a lightweight web server written in Java that is used to build high-performance web applications. It provides a flexible and extensible architecture for handling HTTP requests and responses. Undertow is vulnerable to HTTP request smuggling, which allows an attacker to manipulate HTTP requests in a way that can lead to various security issues.

Vulnerability Detail

The vulnerability in Undertow is a regression in the fix for CVE-2020-10687. It allows for HTTP request smuggling related to CVE-2017-2666, enabling attackers to send requests with invalid characters that can bypass security measures. This vulnerability affects both HTTP/1.x and HTTP/2 protocols. Exploiting this flaw can result in web-cache poisoning, cross-site scripting (XSS) attacks, or unauthorized access to sensitive information from requests other than the attacker's own. The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.8.

Workaround

If upgrading Undertow is not immediately feasible, a possible workaround is to implement a filtering mechanism that sanitizes incoming HTTP requests. This can involve validating and removing any invalid characters or ensuring that the server rejects requests with such characters. Here is an example of a Java Servlet Filter that can be used as a workaround:

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

public class RequestFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // Initialization code
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        if (request instanceof HttpServletRequest) {
            HttpServletRequest httpRequest = (HttpServletRequest) request;
            String requestURI = httpRequest.getRequestURI();
            // Validate and sanitize the requestURI
            // Implement additional checks if necessary
        }
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {
        // Cleanup code
    }

}

This filter can be configured in the web.xml file of the application to intercept incoming requests and perform the necessary checks.

Conclusion

The vulnerability in Undertow allows for HTTP request smuggling, which can lead to various security issues. It is recommended to upgrade to the latest version of Undertow (2.1.6 or later) to fix this vulnerability. If immediate upgrade is not possible, implementing a filtering mechanism as a workaround can help mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for io.undertow:undertow-core →

FAQ