GHSA-mcfg-c4r7-pjpf: uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
uhttpd is a small HTTP server. In unpatched repository snapshots, clientparseheader() in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r->transferchunked, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the chunked POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
uhttpdto a version that resolves this vulnerability.Patch ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs network access to the uhttpd service and must be able to send a crafted HTTP request on a keep-alive connection. The request uses a mixed-case Transfer-Encoding token and a chunked body containing bytes that can be interpreted as a subsequent HTTP request.
Which deployments are affected?
The issue affects unpatched repository snapshots containing the case-sensitive comparison of the Transfer-Encoding value in client_parse_header(). The provided data does not identify specific released versions or default configurations.
What is the impact of successful exploitation?
The unread chunked request body can be parsed as an additional HTTP request, causing HTTP request smuggling and request-boundary desynchronization. The supplied severity vector indicates an integrity impact, with no stated confidentiality or availability impact.
How can the issue be remediated?
Apply the fixes in commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837.