HTTP Request Smuggling in http-proxy-middleware

Executive Summary

The vulnerability exists in the node.js http-proxy-middleware library versions from 3.0.4 until 3.0.7 and 4.1.1 in the fixRequestBody() helper function. When the outgoing Content-Type is multipart/form-data, the function rebuilds the request body by interpolating each key and value directly into the multipart format without neutralizing carriage return and line feed characters (CR/LF). An attacker can exploit this by injecting a \r\n inside a value or key, which allows them to close the current part and inject a new form part. This causes a desynchronization between what the proxy's body parser sees and what the upstream backend ultimately parses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a request/parameter desynchronization across the trust boundary between the proxy and the backend server. Because the proxy evaluates gateway-side policies or validations on a different set of fields than the backend ultimately processes, an attacker can bypass security controls or inject malicious data. This can result in unauthorized actions or data manipulation, impacting the integrity of the application.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in versions 3.0.7 and 4.1.1 of the http-proxy-middleware library.

To mitigate this vulnerability, you should upgrade your http-proxy-middleware dependency to version 3.0.7 or later, or 4.1.1 or later.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a request/parameter desynchronization across the trust boundary, meaning that gateway-side policy or validation performed on the request body is evaluated against a different set of fields than the upstream backend ultimately parses.

Such desynchronization can lead to bypassing security controls or validation mechanisms that are critical for compliance with standards and regulations like GDPR or HIPAA, which require accurate and consistent data handling and validation.

Therefore, this vulnerability could potentially impact compliance by allowing attackers to inject unauthorized form parts that evade detection or validation, undermining data integrity and security controls mandated by these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper neutralization of CRLF sequences in multipart/form-data requests handled by the http-proxy-middleware library versions 3.0.4 to 3.0.6 and 4.0.0 to 4.1.0. Detection involves identifying if your system is running a vulnerable version of http-proxy-middleware and monitoring for suspicious multipart/form-data requests containing CRLF characters in form keys or values.

To detect exploitation attempts on your network, you can capture and inspect HTTP requests for multipart/form-data content types that include CRLF sequences (\r\n) within form field names or values, which are unusual and indicative of an attack.

Example commands to help detect such requests include using network packet capture and text search tools:

• Use tcpdump to capture HTTP traffic on port 80 or 443 (if unencrypted): tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
• Filter captured traffic for multipart/form-data and CRLF sequences using grep: grep -a -E 'Content-Type: multipart/form-data|\r\n' capture.pcap
• If HTTPS is used, inspect application logs or proxy logs for multipart/form-data requests containing suspicious CRLF characters in form fields.

Additionally, verify the version of http-proxy-middleware in your environment by checking your package.json or running: npm list http-proxy-middleware

If the version is between 3.0.4 and 3.0.6 or between 4.0.0 and 4.1.0, your system is vulnerable and should be updated to 3.0.7 or 4.1.1 or later.

Useful 0 Not Useful 0