Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-9622

CVE-2024-9622: HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-9622
GHSA ID
GHSA-5wpr-cj9p-959r
EPSS Score
0.22995%
CWE
CWE-444
Published
10/8/2024
Updated
10/8/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jboss.resteasy:resteasy-netty4-cdimaven< 7.0.0.Alpha3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper state management in the HTTP decoder chain. The analysis shows that Netty's HttpObjectDecoder enters a BAD_MESSAGE state when processing malformed requests, but the surrounding RestEasyHttpRequestDecoder (which wraps Netty's decoder) does not adequately handle this state by either closing the connection or resetting the decoder. This matches the described vulnerability pattern where keep-alive connections remain in a broken state. The GitHub discussion explicitly references RestEasyHttpRequestDecoder's handling of decoder results and proposes fixes at this layer, confirming its role in the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in t** r*st**sy-n*tty* li*r*ry *risin* *rom improp*r **n*lin* o* *TTP r*qu*sts usin* smu**lin* t***niqu*s. W**n *n *TTP smu**lin* r*qu*st wit* *n *S*II *ontrol ***r**t*r is s*nt, it **us*s t** N*tty *ttpO*j**t***o**r to tr*n

Reasoning

T** vuln*r**ility st*ms *rom improp*r st*t* m*n***m*nt in t** `*TTP` ***o**r ***in. T** *n*lysis s*ows t**t N*tty's `*ttpO*j**t***o**r` *nt*rs * `***_M*SS***` st*t* w**n pro**ssin* m*l*orm** r*qu*sts, *ut t** surroun*in* `R*st**sy*ttpR*qu*st***o**r`