CVE-2021-43797: HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Impact
Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.
Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.
Other sources
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch.
Reference: https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
Upstream patch: https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323
— Red Hat
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Netty is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header names. By sending a specially-crafted HTTP(S) transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-43797?
CVE-2021-43797 is a vulnerability in the netty-codec-http package of Netty, allowing unauthorized access to control chars in the header name.
What is the severity of CVE-2021-43797?
CVE-2021-43797 has a high severity rating of 6.5.
How does CVE-2021-43797 impact Netty?
CVE-2021-43797 impacts Netty by enabling unauthorized access to control chars in the header name, potentially leading to security breaches.
What is the recommended version of netty-codec-http to fix CVE-2021-43797?
To fix CVE-2021-43797, it is recommended to update netty-codec-http to version 4.1.72 or higher.
Where can I find more information about CVE-2021-43797?
You can find more information about CVE-2021-43797 on the GitHub Security Advisory page at https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq.