HTTP Request Smuggling Vulnerability in Undertow Package
Summary
CVE-2020-10719: A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. Affects undertow across 3 version ranges.
< 2.1.1-1
< 466e2b0879aea980413c25a1107eb915c66a9aea
< ff6ba3e66bd0a8eb80974783b4152207230b1f19
Fixed in 2.1.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a flexible and performant web server designed for Java applications. It supports both blocking and non-blocking APIs, making it suitable for a wide range of applications. The package is known for its lightweight architecture and ability to handle high concurrency. However, it is susceptible to vulnerabilities that can be exploited through malformed HTTP requests, particularly when large chunk sizes are involved.
Vulnerability Detail
A flaw was identified in Undertow versions prior to 2.1.1.Final, which relates to the processing of invalid HTTP requests with large chunk sizes. This vulnerability allows attackers to exploit HTTP request smuggling techniques, potentially leading to unauthorized access or manipulation of web traffic. The flaw arises from improper handling of HTTP request headers, which can be leveraged to bypass security controls.
How To Fix
Minimum fixed version
2.1.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade undertowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing a web application firewall (WAF) to filter out malicious requests. Additionally, ensure that your application validates and sanitizes all incoming HTTP requests to prevent exploitation.
Conclusion
The vulnerability identified in Undertow poses a significant risk due to its potential for HTTP request smuggling attacks. It is crucial for users of the package to update to the latest version to safeguard their applications. Implementing additional security measures, such as a WAF, can further enhance protection against such vulnerabilities.
See every vulnerability recorded for undertow →
FAQ
HTTP request smuggling is a technique used by attackers to send malicious requests to a server, which can lead to unauthorized actions or data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data leakage, or manipulation of web traffic, posing significant security risks.
Yes, updating to Undertow version 2.1.1-1 or later will mitigate this vulnerability.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for undertow.
