HTTP Request Smuggling in Netty - 4.1.43.Final

[jdordonezn]

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header.

Steps to reproduce the vulnerability

1. The hacker send a request with both "[space]Transfer-Encoding: chunked" header and "Content-Length" header.
2. The legitimate user send a normal request
3. The ELB (Elastic load balancer) send first the request of hacker to Netty and consecutively thr normal request.
4. Netty decodes request by incorrect TE ([space]Transfer-Encoding: chunked") sending to hacker the response that corresponds until null byte and send to legitimate user the response of chunked request from hacker.

• Attack Payload

• Normal request

• Processing of netty

[JLLeitschuh]

It looks like this fix may have been reverted?
netty/netty#10003