Executive brief
mitmproxy is a proxy tool used to intercept and inspect HTTP/HTTPS traffic for security testing and debugging. In affected versions, a malicious client or server can craft HTTP messages that bypass mitmproxy's inspection, allowing a single request to be interpreted as multiple requests by downstream servers. This enables attackers to evade custom security controls, input validation, and access checks that mitmproxy users may have configured.
Technical details
This vulnerability is an HTTP request smuggling flaw (CWE-444) arising from inconsistent HTTP message parsing between mitmproxy and backend servers. A malicious client or server can craft ambiguous HTTP/1.1 messages (leveraging differences in Transfer-Encoding and Content-Length interpretation, and also HTTP/2 scenarios like H2.TE/H2.CL attacks) that mitmproxy parses as one request but which downstream HTTP/1 services parse as multiple requests. The smuggled request is embedded within another request's body, remains invisible in mitmproxy's request list, and bypasses event hooks where users may have implemented access control or sanitization logic. No authentication is required; the attack is network-based and can originate from any HTTP client or server. The vulnerability affects mitmproxy 7.0.2 and earlier versions across all previous releases (0.x through 7.0.2), and was patched in version 7.0.3.
Affected products
- mitmproxy mitmproxy <=7.0.2
Timeline
- 2021-09-16: disclosed: Advisory published
- 2021-09-16: patched: Fix released in mitmproxy 7.0.3 and above