The vulnerability exists in the http4s-blaze server's handling of HTTP/1.1 chunked transfer encoding. Specifically, the server was incorrectly merging trailer headers from the chunked body into the main request headers. This is a classic case of request smuggling through inconsistent interpretation of HTTP requests between a front-end proxy and the backend server.
The root cause of the vulnerability is in the org.http4s.blaze.server.Http1ServerParser.headerComplete function. This function is called for every header parsed from the incoming request. The vulnerable version of the code would add all headers, including trailers, to the same headers collection. An attacker could send a chunked request with malicious headers in the trailer section. A front-end proxy might sanitize the main headers but pass the chunked body with trailers untouched to the backend blaze server. The blaze server would then incorrectly promote these trailer headers into the request's primary headers, allowing the attacker to bypass security controls like IP allow-lists, authentication, or rate-limiting that rely on headers like X-Forwarded-For.
The patch addresses this by introducing a separate buffer, trailers, to store trailer headers. The headerComplete function is modified to check if the parser is currently processing chunked headers (inChunkedHeaders()). If it is, the header is added to the trailers buffer; otherwise, it's added to the main headers buffer. This ensures a strict separation between request headers and trailer headers, mitigating the vulnerability.
Miggo AI
