GHSA-p55c-rmhc-qfm5: uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
uhttpd is a small HTTP server. In unpatched repository snapshots, clientpollpostdata() in client.c consumes an invalid chunk-length line, such as a size exceeding INTMAX, then clears r->contentlength and r->transferchunked without draining the remaining body or setting request.connectionclose. The completion check treats the chunked POST as finished and the keep-alive parser returns to CLIENTSTATEINIT. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
uhttpdto a version that resolves this vulnerability.Patch b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running unpatched repository snapshots of uhttpd are exposed if they accept HTTP connections that can use persistent connections and chunked POST bodies. The issue is network-reachable, requires no privileges or user interaction, but has high attack complexity.
What does an attacker need to send to exploit this?
An attacker needs to send a chunked POST with an invalid chunk-length line, such as a size exceeding INT_MAX, and place attacker-controlled bytes after it that form a complete HTTP request. The server can then interpret those remaining body bytes as a new request on the same keep-alive connection.
What should be done if patching cannot happen immediately?
The provided data identifies commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 as the fixes. No alternative mitigation is provided.
How can I determine whether an instance is affected?
Determine whether the deployed uhttpd build is an unpatched repository snapshot and whether it includes either listed fix commit. Affected behavior occurs when an invalid chunk-length is consumed and the connection remains usable for parsing subsequent attacker-controlled bytes as another request.