CVE-2021-39214: mitmproxy HTTP request smuggling

CVE-2021-39214 · Severity: low · CVSS 3.1 · Published 2021-09-16

mitmproxy is a proxy tool used to intercept and inspect HTTP/HTTPS traffic for security testing and debugging. In affected versions, a malicious client or server can craft HTTP messages that bypass mitmproxy's inspection, allowing a single request to be interpreted as multiple requests by downstream servers. This enables attackers to evade custom security controls, input validation, and access checks that mitmproxy users may have configured.

Technologies: mitmproxy (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-39214 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-39214 being exploited in the wild.
How severe is CVE-2021-39214?
Low severity, with a CVSS score of 3.1, published 16 September 2021.
Which products and versions are affected?
mitmproxy (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.3.
Is there a fix for CVE-2021-39214?
Yes. mitmproxy (PyPI): upgrade to 7.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-39214 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-39214?
Check whether you run mitmproxy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mitmproxy (PyPI): upgrade to 7.0.3 or later
    pip install "mitmproxy>=7.0.3"

Technical details

This vulnerability is an HTTP request smuggling flaw (CWE-444) arising from inconsistent HTTP message parsing between mitmproxy and backend servers. A malicious client or server can craft ambiguous HTTP/1.1 messages (leveraging differences in Transfer-Encoding and Content-Length interpretation, and also HTTP/2 scenarios like H2.TE/H2.CL attacks) that mitmproxy parses as one request but which downstream HTTP/1 services parse as multiple requests. The smuggled request is embedded within another request's body, remains invisible in mitmproxy's request list, and bypasses event hooks where users may have implemented access control or sanitization logic. No authentication is required; the attack is network-based and can originate from any HTTP client or server. The vulnerability affects mitmproxy 7.0.2 and earlier versions across all previous releases (0.x through 7.0.2), and was patched in version 7.0.3.

Affected products

  • mitmproxy mitmproxy <=7.0.2

Identifiers

  • CVE-2021-39214
  • GHSA-22gh-3r9q-xf38
  • PYSEC-2021-328

Timeline

  • 2021-09-16: disclosed: Advisory published
  • 2021-09-16: patched: Fix released in mitmproxy 7.0.3 and above

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.