Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-10687

CVE-2020-10687:
HTTP Request Smuggling in Undertow

4.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-10687
GHSA ID
GHSA-p9w3-gwc2-cr49
EPSS Score
0.43629%
CWE
CWE-444
Published
4/30/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.undertow:undertow-coremaven<= 2.1.0.Final2.2.0.Final

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper validation of HTTP request characters. Key areas would be:

  1. Header parsing (HeaderParser.parseHeader) - Directly processes header name/value pairs
  2. Request line parsing (HttpServerExchange.parseHttpRequest) - Validates method/URI
  3. Core parser (HttpRequestParser.parse) - Handles raw byte processing

While the exact patch isn't shown, the CVE description and related CVE-2017-2666 history indicate these are the most likely candidates. The medium confidence reflects the lack of direct patch code, but these functions are central to HTTP request processing and character validation in Undertow.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *l*w w*s *is*ov*r** in *ll v*rsions o* Un**rtow ***or* Un**rtow *.*.*.*in*l, w**r* *TTP r*qu*st smu**lin* r*l*t** to *V*-****-**** is possi*l* ***inst *TTP/*.x *n* *TTP/* *u* to p*rmittin* inv*li* ***r**t*rs in *n *TTP r*qu*st. T*is *l*w *llows *n

Reasoning

T** vuln*r**ility st*ms *rom improp*r v*li**tion o* *TTP r*qu*st ***r**t*rs. K*y *r**s woul* **: *. *****r p*rsin* (*****rP*rs*r.p*rs******r) - *ir**tly pro**ss*s *****r n*m*/v*lu* p*irs *. R*qu*st lin* p*rsin* (*ttpS*rv*r*x***n**.p*rs**ttpR*qu*st) -