Keran Mu

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4 Description: The issue arises from Apache Traffic Server forwarding malformed HTTP chunked trailer sections to origin servers, which can be utilized for request smuggling and may also lead to cache poisoning if the origin servers are vulnerable. Recommendations: To resolve the issue for versions 8.0.0 through 8.1.10, upgrade to version 8.1.11. To resolve the issue for versions 9.0.0 through 9.2.4, upgrade to version 9.2.5. As a temporary workaround, consider setting the new configuration `proxy.config.http.drop chunked trailers` to prevent forwarding the chunked trailer section.

The issue is related to the chunked decoder of the Squid proxy server, which is associated with the server's interpretation of fragmented syntax encoding. This can allow a remote attacker to perform Request/Response smuggling past firewall and frontend security systems, potentially enabling direct interaction with the server.

The issue is related to improper input validation in Apache Tomcat, where the server does not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests, leading to the possibility of request smuggling when behind a reverse proxy.

The issue in Gevent is related to insufficient validation of executed requests in the WSGIServer component, allowing a remote attacker to escalate privileges via a crafted script. This can impact the integrity, availability, and confidentiality of protected information.

The issue is related to the implementation of the HTTP/1 protocol in protocol-http1, specifically with the handling of HTTP requests. The problem arises from the acceptance of non-standard formats for the Content-Length header and chunk size, which can lead to desynchronization when forwarding through multiple HTTP parsers. This can potentially result in HTTP request smuggling and firewall bypassing. The behavior does not follow the corresponding RFCs, which define the format for chunk size, chunk data, and chunk extension. There are no known real-world exploits or practical attacks reported.