HTTP::Parser::XS NUL Byte PATH_INFO Truncation

Executive Summary

HTTP::Parser::XS versions before 0.18 for Perl have a flaw where PATH_INFO is truncated at an encoded NUL byte (%00) during URL decoding. The XS parser uses strlen() to measure the decoded path, which stops at the first null byte, causing PATH_INFO to end prematurely. The pure-Perl backend is not affected.

Useful 0 Not Useful 0

Detection Guidance

Check if HTTP::Parser::XS versions before 0.18 are installed by running: perl -MHTTP::Parser::XS -e 'print $HTTP::Parser::XS::VERSION' | grep -E '^0\.(1[0-7]|[0-9])'

Inspect web server logs for requests containing %00 in the path, which may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could send a path containing %00 to exploit the truncation. This might bypass path-based access controls if a proxy or filter checks the full path while the application routes based on the truncated PATH_INFO.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade HTTP::Parser::XS to version 0.18 or later using: cpan HTTP::Parser::XS

Review and update web server configurations to validate and sanitize input paths before processing.

Useful 0 Not Useful 0