CVE-2024-33452

Name of the Vulnerable Software and Affected Versions OpenResty/lua-nginx-module (affected versions not specified)

Description The issue concerns HTTP Request Smuggling in HEAD requests. When handling HTTP/1.1 requests, the lua-nginx-module incorrectly parses HEAD requests with a body, treating the request body as a new, separate request. This can lead to desynchronization of proxy servers in a chain. Proxy servers using the lua-nginx-module, such as Kong Gateway and Apache APISIX, are vulnerable to this attack. An attacker can exploit this to inject malicious responses, bypass front-proxy protection, or steal other users' responses.

Technical details about exploitation include:

The estimated number of potentially affected devices worldwide is not provided. However, the issue can be exploited in real-world scenarios, such as injecting XSS attacks or bypassing Cloudflare protection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.