HTTP Request Smuggling Affecting io.netty:netty-codec-http package, versions [,4.1.133.Final)[4.2.0.Alpha1,4.2.13.Final)

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to HTTP Request Smuggling in the setUri function. An attacker can inject arbitrary CRLF sequences into the HTTP or RTSP request line by supplying crafted input to setUri, leading to the creation of additional requests or manipulation of request boundaries when the object is serialized by HttpRequestEncoder or RtspEncoder. This can result in request smuggling, desynchronization, or unauthorized access to internal APIs if attacker-controlled input is passed to setUri and subsequently encoded.

Note:

This is only exploitable if all of the following conditions are met:

• The application uses DefaultHttpRequest or DefaultFullHttpRequest;

• The request object is created first and later modified through setUri();

• The value passed into setUri() is attacker-controlled or attacker-influenced;

• The object is eventually serialized by HttpRequestEncoder or RtspEncoder.

• GitHub Advisory
• GitHub Commit