CVE-2022-1705: stdlib - Improper sanitization of Transfer-Encoding header
Summary
CVE-2022-1705: Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to re... Affects golang-1.15 versions < 1ed3c127daceaffb9aadc806ba60f0b51b47421b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language standard library. It provides a collection of essential functions and types for various common tasks in Go programming. The package is widely used in Go applications and is considered a fundamental component of the language. However, a vulnerability has been discovered in the net/http module of the stdlib package.
Vulnerability Detail
The vulnerability, identified as CVE-2022-1705, exists in the HTTP/1 client of the net/http module in stdlib. It arises from the improper sanitization of Transfer-Encoding headers. This flaw allows the acceptance of some invalid Transfer-Encoding headers, which can lead to HTTP request smuggling attacks when combined with an intermediate server that also fails to reject the header as invalid. HTTP request smuggling can result in various security risks, such as bypassing security controls, unauthorized access, and potential data leakage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers can manually sanitize the Transfer-Encoding headers in their code to ensure they are valid and reject any invalid headers. Here's an example of how to sanitize the Transfer-Encoding header in Go:
import (
"net/http"
"strings"
)
func sanitizeTransferEncoding(req *http.Request) {
if req.TransferEncoding != nil {
for i, encoding := range req.TransferEncoding {
req.TransferEncoding[i] = strings.TrimSpace(encoding)
}
}
}
Conclusion
In conclusion, the stdlib package in Go programming language versions before 1.17.12 and 1.18.4 is vulnerable to an improper sanitization of Transfer-Encoding headers. This vulnerability can lead to HTTP request smuggling attacks, posing security risks. It is crucial to update the stdlib package to the fixed versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability allows for HTTP request smuggling attacks, which can lead to security bypasses, unauthorized access, and potential data leakage.
The vulnerability affects versions of the stdlib package before 1.17.12 and 1.18.4.
At the time of this report, there are no known public exploits targeting this vulnerability.
Yes, the CVSS score for this vulnerability is 6.5, indicating a medium severity level.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2022-1705.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
