High Severity

gunicorn

HTTP Request Smuggling via Improper Transfer-Encoding Validation

Gunicorn version 21.2.0 is vulnerable to HTTP Request Smuggling due to improper validation of the 'Transfer-Encoding' header. This issue was identified and reported, but the fixed version is not specified.

Available publicly on Jul 25 2024

7.5

CVSS:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Credit:

sayoojbkumar
Threat Overview

The vulnerability arises because Gunicorn does not properly validate the 'Transfer-Encoding' header as specified in RFC standards. When the 'Transfer-Encoding' header is not strictly 'chunked', Gunicorn falls back to using the 'Content-Length' header. This discrepancy can be exploited to perform HTTP Request Smuggling attacks, leading to various security issues such as cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.

Attack Scenario

An attacker can craft a malicious HTTP request with both 'Content-Length' and 'Transfer-Encoding' headers. By specifying an invalid 'Transfer-Encoding' value, the attacker can trick the proxy into using 'Transfer-Encoding' while Gunicorn falls back to 'Content-Length'. This allows the attacker to smuggle a hidden request to a protected endpoint, such as '/admin', bypassing security controls.

Who is affected

Users and administrators running Gunicorn version 21.2.0 are affected by this vulnerability. This includes web applications and services that rely on Gunicorn for handling HTTP requests.

Technical Report
Want more out of Sightline?

Sightline offers even more for premium customers

Go Premium

We have - related security advisories that are available with Sightline Premium.