Vulnerabilities > CVE-2021-21295 - HTTP Request Smuggling vulnerability in multiple products

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.

Vulnerable Configurations

Part	Description	Count
Application	Netty Netty Netty - Netty Netty 3.2.4 Netty Netty 3.2.5 Netty Netty 3.2.6 Netty Netty 3.2.7 Netty Netty 3.2.8 Netty Netty 3.2.9 Netty Netty 3.2.10 Netty Netty 3.3.0 Netty Netty 3.3.1 Netty Netty 3.4.0 Netty Netty 3.4.1 Netty Netty 3.4.2 Netty Netty 3.4.3 Netty Netty 3.4.4 Netty Netty 3.4.5 Netty Netty 3.4.6 Netty Netty 3.5.0 Netty Netty 3.5.1 Netty Netty 3.5.2 Netty Netty 3.5.3 Netty Netty 3.5.4 Netty Netty 3.5.5 Netty Netty 3.5.6 Netty Netty 3.5.7 Netty Netty 3.5.8 Netty Netty 3.5.9 Netty Netty 3.5.10 Netty Netty 3.5.11 Netty Netty 3.5.12 Netty Netty 3.5.13 Netty Netty 3.6.0 Netty Netty 3.6.1 Netty Netty 3.6.2 Netty Netty 3.6.3 Netty Netty 3.6.4 Netty Netty 3.6.5 Netty Netty 3.6.6 Netty Netty 3.6.7 Netty Netty 3.6.8 Netty Netty 3.6.9 Netty Netty 3.6.10 Netty Netty 3.7.0 Netty Netty 3.7.1 Netty Netty 3.8.0 Netty Netty 3.8.1 Netty Netty 3.8.2 Netty Netty 3.8.3 Netty Netty 3.9.0 Netty Netty 3.9.1 Netty Netty 3.9.1.1 Netty Netty 3.9.2 Netty Netty 3.9.3 Netty Netty 3.9.4 Netty Netty 3.9.5 Netty Netty 3.9.6 Netty Netty 3.9.7 Netty Netty 3.9.8 Netty Netty 3.9.9 Netty Netty 3.10.0 Netty Netty 3.10.1 Netty Netty 3.10.2 Netty Netty 3.10.3 Netty Netty 3.10.4 Netty Netty 3.10.5 Netty Netty 3.10.6 Netty Netty 4.0.0 Netty Netty 4.0.1 Netty Netty 4.0.2 Netty Netty 4.0.3 Netty Netty 4.0.4 Netty Netty 4.0.5 Netty Netty 4.0.6 Netty Netty 4.0.7 Netty Netty 4.0.8 Netty Netty 4.0.9 Netty Netty 4.0.10 Netty Netty 4.0.11 Netty Netty 4.0.12 Netty Netty 4.0.13 Netty Netty 4.0.14 Netty Netty 4.0.15 Netty Netty 4.0.16 Netty Netty 4.0.17 Netty Netty 4.0.18 Netty Netty 4.0.19 Netty Netty 4.0.20 Netty Netty 4.0.21 Netty Netty 4.0.22 Netty Netty 4.0.23 Netty Netty 4.0.24 Netty Netty 4.0.25 Netty Netty 4.0.26 Netty Netty 4.0.27 Netty Netty 4.0.28 Netty Netty 4.0.29 Netty Netty 4.0.30 Netty Netty 4.0.31 Netty Netty 4.0.32 Netty Netty 4.0.33 Netty Netty 4.0.34 Netty Netty 4.0.35 Netty Netty 4.0.36 Netty Netty 4.0.37 Netty Netty 4.0.38 Netty Netty 4.0.39 Netty Netty 4.0.40 Netty Netty 4.0.41 Netty Netty 4.0.42 Netty Netty 4.0.43 Netty Netty 4.0.44 Netty Netty 4.0.45 Netty Netty 4.0.46 Netty Netty 4.0.47 Netty Netty 4.0.48 Netty Netty 4.0.49 Netty Netty 4.0.50 Netty Netty 4.0.51 Netty Netty 4.0.52 Netty Netty 4.0.53 Netty Netty 4.0.54 Netty Netty 4.0.55 Netty Netty 4.0.56 Netty Netty 4.1 Netty Netty 4.1.0 Netty Netty 4.1.1 Netty Netty 4.1.2 Netty Netty 4.1.3 Netty Netty 4.1.4 Netty Netty 4.1.5 Netty Netty 4.1.6 Netty Netty 4.1.7 Netty Netty 4.1.8 Netty Netty 4.1.9 Netty Netty 4.1.10 Netty Netty 4.1.11 Netty Netty 4.1.12 Netty Netty 4.1.13 Netty Netty 4.1.14 Netty Netty 4.1.15 Netty Netty 4.1.16 Netty Netty 4.1.17 Netty Netty 4.1.18 Netty Netty 4.1.19 Netty Netty 4.1.20 Netty Netty 4.1.21 Netty Netty 4.1.22 Netty Netty 4.1.23 Netty Netty 4.1.24 Netty Netty 4.1.25 Netty Netty 4.1.26 Netty Netty 4.1.27 Netty Netty 4.1.28 Netty Netty 4.1.29 Netty Netty 4.1.30 Netty Netty 4.1.31 Netty Netty 4.1.32 Netty Netty 4.1.33 Netty Netty 4.1.34 Netty Netty 4.1.35 Netty Netty 4.1.36 Netty Netty 4.1.37 Netty Netty 4.1.38 Netty Netty 4.1.39 Netty Netty 4.1.40 Netty Netty 4.1.41 Netty Netty 4.1.42 Netty Netty 4.1.43 Netty Netty 4.1.44 Netty Netty 4.1.45 Netty Netty 4.1.46 Netty Netty 4.1.47 Netty Netty 4.1.48 Netty Netty 4.1.49 Netty Netty 4.1.50 Netty Netty 4.1.51 Netty Netty 4.1.52 Netty Netty 4.1.53 Netty Netty 4.1.54 Netty Netty 4.1.55 Netty Netty 4.1.56 Netty Netty 4.1.57 Netty Netty 4.1.58 Netty Netty 4.1.59	228
Application	Netapp Netapp Oncommand Workflow Automation - Netapp Oncommand API Services -	2
Application	Quarkus Quarkus Quarkus 0.0.1 Quarkus Quarkus 0.1.0 Quarkus Quarkus 0.2.0 Quarkus Quarkus 0.3.0 Quarkus Quarkus 0.4.0 Quarkus Quarkus 0.5.0 Quarkus Quarkus 0.6.0 Quarkus Quarkus 0.7.0 Quarkus Quarkus 0.8.0 Quarkus Quarkus 0.9.0 Quarkus Quarkus 0.9.1 Quarkus Quarkus 0.10.0 Quarkus Quarkus 0.11.0 Quarkus Quarkus 0.12.0 Quarkus Quarkus 0.13.0 Quarkus Quarkus 0.13.1 Quarkus Quarkus 0.13.2 Quarkus Quarkus 0.13.3 Quarkus Quarkus 0.14.0 Quarkus Quarkus 0.15.0 Quarkus Quarkus 0.16.0 Quarkus Quarkus 0.16.1 Quarkus Quarkus 0.17.0 Quarkus Quarkus 0.18.0 Quarkus Quarkus 0.19.0 Quarkus Quarkus 0.19.1 Quarkus Quarkus 0.20.0 Quarkus Quarkus 0.21.0 Quarkus Quarkus 0.21.1 Quarkus Quarkus 0.21.2 Quarkus Quarkus 0.22.0 Quarkus Quarkus 0.23.0 Quarkus Quarkus 0.23.1 Quarkus Quarkus 0.23.2 Quarkus Quarkus 0.24.0 Quarkus Quarkus 0.25.0 Quarkus Quarkus 0.26.0 Quarkus Quarkus 0.26.1 Quarkus Quarkus 0.27.0 Quarkus Quarkus 0.28.0 Quarkus Quarkus 0.28.1 Quarkus Quarkus 1.0.0 Quarkus Quarkus 1.0.1 Quarkus Quarkus 1.1.0 Quarkus Quarkus 1.1.1 Quarkus Quarkus 1.2.0 Quarkus Quarkus 1.2.1 Quarkus Quarkus 1.3.0 Quarkus Quarkus 1.3.1 Quarkus Quarkus 1.3.2 Quarkus Quarkus 1.3.3 Quarkus Quarkus 1.3.4 Quarkus Quarkus 1.4.0 Quarkus Quarkus 1.4.1 Quarkus Quarkus 1.4.2 Quarkus Quarkus 1.5.0 Quarkus Quarkus 1.5.1 Quarkus Quarkus 1.5.2 Quarkus Quarkus 1.6.0 Quarkus Quarkus 1.6.1 Quarkus Quarkus 1.7.0 Quarkus Quarkus 1.7.1 Quarkus Quarkus 1.7.2 Quarkus Quarkus 1.7.3 Quarkus Quarkus 1.7.4 Quarkus Quarkus 1.7.5 Quarkus Quarkus 1.7.6 Quarkus Quarkus 1.8.0 Quarkus Quarkus 1.8.1 Quarkus Quarkus 1.8.2 Quarkus Quarkus 1.8.3 Quarkus Quarkus 1.9.0 Quarkus Quarkus 1.9.1 Quarkus Quarkus 1.9.2 Quarkus Quarkus 1.10.0 Quarkus Quarkus 1.10.1 Quarkus Quarkus 1.10.2 Quarkus Quarkus 1.10.3 Quarkus Quarkus 1.10.4 Quarkus Quarkus 1.10.5 Quarkus Quarkus 1.11.0 Quarkus Quarkus 1.11.1 Quarkus Quarkus 1.11.2 Quarkus Quarkus 1.11.3 Quarkus Quarkus 1.11.4 Quarkus Quarkus 1.11.5 Quarkus Quarkus 1.11.6 Quarkus Quarkus 1.11.7 Quarkus Quarkus 1.12.0 Quarkus Quarkus 1.12.1 Quarkus Quarkus 1.12.2 Quarkus Quarkus 1.13.0 Quarkus Quarkus 1.13.1 Quarkus Quarkus 1.13.2 Quarkus Quarkus 1.13.3 Quarkus Quarkus 1.13.4 Quarkus Quarkus 1.13.5 Quarkus Quarkus 1.13.6 Quarkus Quarkus 1.13.7	134
Application	Apache Apache Kudu - Apache Kudu 0.7.0 Apache Kudu 0.7.1 Apache Kudu 0.8.0 Apache Kudu 0.9.0 Apache Kudu 0.9.1 Apache Kudu 0.10.0 Apache Kudu 1.0.0 Apache Kudu 1.0.1 Apache Kudu 1.1.0 Apache Kudu 1.2.0 Apache Kudu 1.3.0 Apache Kudu 1.3.1 Apache Kudu 1.4.0 Apache Kudu 1.5.0 Apache Kudu 1.6.0 Apache Kudu 1.7.0 Apache Kudu 1.7.1 Apache Kudu 1.8.0 Apache Kudu 1.9.0 Apache Kudu 1.10.0 Apache Kudu 1.10.1 Apache Kudu 1.11.0 Apache Kudu 1.11.1 Apache Kudu 1.12.0 Apache Kudu 1.13.0 Apache Kudu 1.14.0 Apache Kudu 1.15.0 Apache Zookeeper 3.5.9	77
Application	Oracle Oracle Communications Cloud Native Core Policy 1.14.0	1
OS	Debian Debian Debian Linux 10.0	1

Common Weakness Enumeration (CWE)

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Common Attack Pattern Enumeration and Classification (CAPEC)

HTTP Request Splitting
HTTP Request Splitting (also known as HTTP Request Smuggling) is an attack pattern where an attacker attempts to insert additional HTTP requests in the body of the original (enveloping) HTTP request in such a way that the browser interprets it as one request but the web server interprets it as two. There are several ways to perform HTTP request splitting attacks. One way is to include double Content-Length headers in the request to exploit the fact that the devices parsing the request may each use a different header. Another way is to submit an HTTP request with a "Transfer Encoding: chunked" in the request header set with setRequestHeader to allow a payload in the HTTP Request that can be considered as another HTTP Request by a subsequent parsing entity. A third way is to use the "Double CR in an HTTP header" technique. There are also a few less general techniques targeting specific parsing vulnerabilities in certain web servers.
HTTP Request Smuggling
HTTP Request Smuggling results from the discrepancies in parsing HTTP requests between HTTP entities such as web caching proxies or application firewalls. Entities such as web servers, web caching proxies, application firewalls or simple proxies often parse HTTP requests in slightly different ways. Under specific situations where there are two or more such entities in the path of the HTTP request, a specially crafted request is seen by two attacked entities as two different sets of requests. This allows certain requests to be smuggled through to a second entity without the first one realizing it.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References