Critical Request Smuggling Vulnerability in Varnish Cache
Summary
ALPINE-CVE-2022-23959: In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 conn... Affects varnish versions < 6.5.2-r1. Fixed in 6.5.2-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Varnish Cache is a powerful HTTP accelerator designed to speed up web applications by caching content. It is widely used for its ability to handle high traffic loads and improve response times. However, certain versions of Varnish Cache are vulnerable to a request smuggling issue, which can lead to severe security implications, including unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability, identified as CVE-2022-23959, affects Varnish Cache versions prior to 6.6.2 and 7.x before 7.0.2. It arises from improper handling of HTTP/1 connections, allowing attackers to exploit the request smuggling flaw. This can lead to malicious requests being processed by the server, potentially allowing unauthorized access to sensitive information or manipulation of server behavior. The CVSS score for this vulnerability is 9.1, indicating a critical severity level.
How To Fix
Minimum fixed version
6.5.2-r1
This is the first release that contains the fix.
sudo apk add --upgrade varnishTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as web application firewalls (WAFs) to filter and monitor incoming requests, thereby mitigating the risk of request smuggling until the package can be updated.
Conclusion
The request smuggling vulnerability in Varnish Cache poses a significant risk to applications using affected versions. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your web applications.
See every vulnerability recorded for varnish →
FAQ
Request smuggling is a technique used by attackers to send malicious requests to a server, exploiting discrepancies in how different components of the server handle HTTP requests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, manipulation of server responses, and potential data breaches.
Yes, you should upgrade to Varnish Cache version 6.5.2-r1 or 6.6.2-r0, or 7.0.2-r0 depending on your Alpine version.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for varnish.
