Fallos del tipo CWE-444

365 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando proxies, load balancers ou firewalls interpretam requisições HTTP de forma diferente do servidor backend. Um atacante explora essa discrepância enviando requisições ambíguas (com headers conflitantes ou corpo malformado) que são parseadas de modos distintos por camadas diferentes da infraestrutura, permitindo contornar controles de segurança ou injetar requisições não autorizadas no backend.

Ejemplo

Um proxy usa Content-Length para determinar o fim da requisição, enquanto o servidor backend usa Transfer-Encoding: chunked. O atacante envia uma requisição que contém dois requests: um legítimo (que passa pelo proxy) e um malicioso embutido no corpo (que o backend processa como requisição separada). Resultado: bypass de WAF ou injeção de cache envenenado.

Cómo mitigar

Normalize o parsing: garanta que todas as camadas (proxy, load balancer, aplicação) usem as mesmas regras RFC 7230 para interpretar headers Content-Length e Transfer-Encoding; desabilite métodos ambíguos no proxy (reject requisições com ambos os headers); mantenha proxies e servidores sincronizados em versões e configurações de parsing HTTP.

CVE-2022-20713MEDIUMA vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefeEPSS 1.9%CVE-2017-12165LOWIt was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possEPSS 1.9%CVE-2022-45059HIGHAn issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish CacEPSS 1.8%CVE-2022-42252HIGHApache Tomcat request smuggling via malformed content-lengthEPSS 1.8%CVE-2022-24761HIGHHTTP Request Smuggling in waitressEPSS 1.8%CVE-2023-33193CRITICALEmby Server Proxy Header Spoofing VulnerabilityEPSS 1.7%CVE-2024-23452HIGHApache bRPC: HTTP request smuggling vulnerabilityEPSS 1.6%CVE-2022-24766CRITICALInsufficient Protection against HTTP Request Smuggling in mitmproxyEPSS 1.6%CVE-2023-33934CRITICALApache Traffic Server: Differential fuzzing for HTTP request parsing discrepanciesEPSS 1.6%CVE-2026-93574MEDIUMIo.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingEPSS 1.4%CVE-2023-37276MEDIUMaiohttp vulnerable to HTTP request smugglingEPSS 1.3%CVE-2026-2332HIGHHTTP Request Smuggling via Chunked Extension Quoted-String ParsingEPSS 1.3%CVE-2026-63385CRITICALLibevent: HTTP header handling bugs create risk of access control bypass.EPSS 1.3%CVE-2021-41267MEDIUMWebcache Poisoning in SymfonyEPSS 1.3%CVE-2020-10687—A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possEPSS 1.2%CVE-2021-41136LOWInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in pumaEPSS 1.2%CVE-2021-20220—A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possiEPSS 1.2%CVE-2023-29141CRITICALAn issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur EPSS 1.2%CVE-2025-31137HIGHRemix and React Router allow URL manipulation via Host / X-Forwarded-Host headersEPSS 1.2%CVE-2024-34350HIGHNext.js Vulnerable to HTTP Request SmugglingEPSS 1.2%