Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.http4s:http4s-blaze-server_2.13 | maven | <= 0.23.17 | 0.23.18 |
| org.http4s:blaze-http_2.13 | maven | <= 0.23.17 | 0.23.18 |
| org.http4s:blaze-http_3 | maven | <= 0.23.17 | 0.23.18 |
| org.http4s:blaze-http_3 | maven | >= 1.0.0-M1, <= 1.0.0-M41 | 1.0.0-M42 |
| org.http4s:blaze-http_2.13 | maven | >= 1.0.0-M1, <= 1.0.0-M41 | 1.0.0-M42 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the HTTP parser of the blaze library, which had several laxities in its implementation, making it susceptible to HTTP request smuggling attacks. The analysis of the provided patches reveals that the core of the vulnerability is located in two main functions: org.http4s.blaze.server.Http1ServerParser.headerComplete and org.http4s.blaze.http.parser.BodyAndHeaderParser.parseHeaders. These functions were responsible for parsing and validating HTTP headers. The patches introduce stricter checks in these functions to adhere more closely to RFC specifications. Specifically, the patches add validations to:
obs-fold.Content-Length headers.Transfer-Encoding and Content-Length headers.tchar characters.Transfer-Encoding values other than chunked.Prior to these patches, the lack of these validations meant that blaze could interpret a malformed HTTP request differently from a front-end proxy server, creating the disagreement in request boundaries that is necessary for request smuggling. An attacker could exploit this to bypass security controls, poison web caches, or desynchronize the request queue to obtain responses meant for other users. Therefore, any runtime profile of a vulnerable application would show these two functions, Http1ServerParser.headerComplete and BodyAndHeaderParser.parseHeaders, as the key entry points for processing potentially malicious HTTP requests.
org.http4s.blaze.server.Http1ServerParser.headerCompleteblaze-server/src/main/scala/org/http4s/blaze/server/Http1ServerParser.scala
org.http4s.blaze.http.parser.BodyAndHeaderParser.parseHeadershttp/src/main/java/org/http4s/blaze/http/parser/BodyAndHeaderParser.java