Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a CRLF injection in Netty's HttpPostRequestEncoder. It occurs because the filename in a multipart form data request is not properly sanitized for carriage return (CR) and line feed (LF) characters. An attacker can provide a crafted filename, for example during a file upload, which includes CRLF sequences followed by arbitrary MIME headers.
The root cause was traced to the setFilename methods in io.netty.handler.codec.http.multipart.DiskFileUpload and io.netty.handler.codec.http.multipart.MemoryFileUpload. These methods only performed a null check and did not validate the filename for illegal characters. When HttpPostRequestEncoder later constructs the multipart body, it concatenates this unvalidated filename directly into the Content-Disposition header, allowing the injected headers to be written into the request body.
The patch addresses this by introducing a new utility method, FileUploadUtil.validateFileNameForMultiPart, which checks for control characters (including CR and LF), DEL, double-quotes, and backslashes. The setFilename methods in DiskFileUpload and MemoryFileUpload were updated to use this new validation method, thus preventing the injection at the source. During exploitation, a profiler would show calls to setFilename on a FileUpload object, followed by a call to HttpPostRequestEncoder.addBodyHttpData to add the malicious part, and finally HttpPostRequestEncoder.readChunk where the multipart body with the injected headers is actually constructed.
io.netty.handler.codec.http.multipart.DiskFileUpload.setFilenamecodec-http/src/main/java/io/netty/handler/codec/http/multipart/DiskFileUpload.java
io.netty.handler.codec.http.multipart.MemoryFileUpload.setFilenamecodec-http/src/main/java/io/netty/handler/codec/http/multipart/MemoryFileUpload.java
io.netty.handler.codec.http.multipart.MixedFileUpload.setFilenamecodec-http/src/main/java/io/netty/handler/codec/http/multipart/MixedFileUpload.java
io.netty.handler.codec.http.multipart.HttpPostRequestEncoder.addBodyHttpDatacodec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestEncoder.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty:netty-codec-http | maven | >= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| io.netty:netty-codec-http | maven | < 4.1.136.Final | 4.1.136.Final |