CVE-2024-1135: HTTP Request Smuggling in benoitc/gunicorn
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
Other sources
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability has been shown to allow access to endpoints restricted by gunicorn. This issue has been addressed in version 22.0.0.
To be affected users must have a network path which does not filter out invalid requests. These users are advised to block access to restricted endpoints via a firewall or other mechanism if they are unable to update.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/gunicornto a version that resolves this vulnerability.Fixed in 22.0.0 - Upgrade
Upgrade
redhat/gunicornto a version that resolves this vulnerability.Fixed in 22.0.0 - Upgrade
Upgrade
benoitc/gunicornto a version that resolves this vulnerability.Fixed in 22.0.0 - Compensating control
If unable to update, block access to restricted endpoints via a firewall or other network mechanism, since affected users must have a network path that does not filter out invalid requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1135?
CVE-2024-1135 is classified as a high-severity vulnerability due to the potential for HTTP Request Smuggling and unauthorized access.
How do I fix CVE-2024-1135?
To fix CVE-2024-1135, upgrade to Gunicorn version 22.0.0 or later.
What vulnerabilities does CVE-2024-1135 expose?
CVE-2024-1135 exposes systems to HTTP Request Smuggling attacks that can bypass security controls.
Which versions of Gunicorn are affected by CVE-2024-1135?
Gunicorn versions prior to 22.0.0 are affected by CVE-2024-1135.
Who is affected by CVE-2024-1135?
Any organization using affected versions of Gunicorn in their applications may be vulnerable to CVE-2024-1135.