CVE-2019-16869: Netty HTTP request smuggling via header whitespace mishandling

Executive brief

Netty is a popular networking framework used by many Java-based applications and servers to handle web traffic. A vulnerability in how it processes web requests allows an attacker to 'smuggle' hidden requests past security filters. This can lead to unauthorized access to internal systems, bypass of security controls, or interference with other users' web sessions.

Technical details

A request smuggling vulnerability exists in Netty due to improper parsing of HTTP headers. Specifically, the framework mishandles whitespace characters preceding the colon in header fields (e.g., 'Transfer-Encoding : chunked'). This discrepancy in header parsing between Netty and other downstream proxies or servers allows an attacker to craft malicious requests that are interpreted differently by different components in the request chain. An unauthenticated remote attacker can exploit this to bypass security constraints or poison web caches. The issue is resolved in Netty version 4.1.42.Final.

Affected products

• Netty netty-all >= 4.0.0.Beta1, < 4.1.42.Final
• Netty netty >= 3.3.0.Final, <= 4.0.0.Alpha8
• JBoss netty <= 3.2.9.Final

Timeline

• 2019-10-11: advisory: GitHub Advisory published
• 2019-10-11: disclosed: NVD publication date
• 2019-09-26: patched: Netty 4.1.42.Final released

References

• https://api.github.com/users/G-Rath
• https://github.com/G-Rath
• https://api.github.com/users/G-Rath/gists%7B/gist_id%7D
• https://api.github.com/users/G-Rath/repos
• https://avatars.githubusercontent.com/u/3151613?v=4
• https://api.github.com/users/G-Rath/events%7B/privacy%7D