Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the WebSocket handshaking process for protocol versions 07 and 08. The analysis of the patch commits reveals that the newHandshakeResponse methods in WebSocketServerHandshaker07 and WebSocketServerHandshaker08 were missing crucial validation checks. Specifically, they did not verify that the HTTP request contained the Connection: Upgrade and Upgrade: websocket headers, which are required to properly establish a WebSocket connection. This flaw could be exploited by an attacker to perform an HTTP request smuggling attack. By sending a specially crafted request, an attacker could cause a protocol switch to WebSocket that would be missed by an intermediary proxy, allowing the smuggling of arbitrary HTTP requests. The identified vulnerable functions are the newHandshakeResponse methods where the validation was added, and the parent handshake method which is the entry point for this process.
io.netty.handler.codec.http.websocketx.WebSocketServerHandshaker07.newHandshakeResponsecodec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker07.java
io.netty.handler.codec.http.websocketx.WebSocketServerHandshaker08.newHandshakeResponsecodec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker08.java
io.netty.handler.codec.http.websocketx.WebSocketServerHandshaker.handshakecodec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty:netty-codec-http | maven | >= 4.2.0.Final, <= 4.2.15.Final | 4.2.16.Final |
| io.netty:netty-codec-http | maven | < 4.1.136.Final | 4.1.136.Final |