Pound - Request Smuggling Vulnerability
Summary
DLA-1280-1: pound - security update. Affects pound versions < 2.6-2+deb7u2. Fixed in 2.6-2+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pound is a reverse proxy and load balancer software that allows for the distribution of client requests across multiple servers. It acts as an intermediary between clients and servers, forwarding requests and responses. The vulnerability in Pound allows attackers to send specially crafted HTTP requests, which may be interpreted differently by Pound and the web server or reverse proxy it interacts with. This can lead to various exploitations, including partial cache poisoning, bypassing firewall protection, and cross-site scripting (XSS) attacks.
Vulnerability Detail
The request smuggling vulnerability in Pound enables attackers to manipulate the HTTP requests in a way that Pound interprets them differently from the target server. By exploiting this vulnerability, attackers can achieve several malicious objectives. For example, they can poison the cache partially, tricking the server into serving compromised content. Additionally, they can bypass firewall protection by sending requests that appear harmless to the firewall but are interpreted differently by Pound. This can allow attackers to access restricted resources. Furthermore, the vulnerability can be leveraged for cross-site scripting attacks, where malicious scripts are injected into web pages viewed by users.
How To Fix
Minimum fixed version
2.6-2+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade poundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by upgrading Pound to the patched version is the most effective solution.
Conclusion
The request smuggling vulnerability in Pound can have serious implications, including cache poisoning, firewall bypass, and cross-site scripting attacks. It is crucial to promptly upgrade Pound to the patched version (2.6-2+deb7u2 or later) to mitigate these risks. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for pound →
FAQ
Pound is a reverse proxy and load balancer software used to distribute client requests across multiple servers.
Request smuggling is a technique where attackers manipulate HTTP requests in a way that intermediaries interpret them differently from the target server.
The vulnerability in Pound can lead to partial cache poisoning, bypassing firewall protection, and cross-site scripting attacks.
To fix this vulnerability, upgrade the Pound package to version 2.6-2+deb7u2 or later.
There is no specific workaround mentioned for this vulnerability. Upgrading Pound to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for pound.
