Undertow-core vulnerable to HTTP Request Smuggling
Moderate severity
GitHub Reviewed
Published
Oct 19, 2018
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Package
Affected versions
< 1.3.31
>= 1.4.0, < 1.4.17
Patched versions
1.3.31
1.4.17
Description
Published to the GitHub Advisory Database
Oct 19, 2018
Reviewed
Jun 16, 2020
Last updated
Jan 9, 2023
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
References