Emmanuel Lécharny created DIRMINA-1204:
------------------------------------------
Summary: HTTP Body offset computed in chars, not bytes, desyncs
framing
Key: DIRMINA-1204
URL: https://issues.apache.org/jira/browse/DIRMINA-1204
Project: MINA
Issue Type: Bug
Components: Protocol - HTTP
Affects Versions: 2.2.9
Reporter: Emmanuel Lécharny
Fix For: 2.2.10
Behind a connection-reusing front-end that tolerates non-ASCII header bytes or
whitespace before the header colon, the attacker crafts a request so MINA's
computed body boundary differs from the front-end's by a chosen number of bytes
and places a complete smuggled request inside that differential window.
MINA parses the smuggled request as a new top-level request on the shared
connection; the response queue desyncs for subsequent users.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
