http request smuggling, cause by obfuscating TE header

Expected behavior

ignore obfuscating TE header(“Transfer-Encoding : chunked” vs “Transfer-Encoding: chunked”)

Actual behavior

use Transfer-Encoding[space] as Transfer-Encoding

Steps to reproduce

1、topology: client→elb→nettyServer 2、client send a request with both content-length and trunked-encoded[space] 3、elb ignored trunked-encoded[space], but use content-length 4、netty use trunked-encoded[space]

Minimal yet complete reproducer code (or URL to code)

when header field end with space but not colon, shoud the space be ignored? can not found proof in https://greenbytes.de/tech/webdav/rfc7230.html#header.fields.

code in io.netty.handler.codec.http.HttpObjectDecoder#splitHeader

for (nameEnd = nameStart; nameEnd < length; nameEnd ++) {
            char ch = sb.charAt(nameEnd);
            if (ch == ':' || <font color="#dd0000">Character.isWhitespace(ch)</font>) {
                break;
            }
 }

Netty version

all

JVM version (e.g. java -version)

OS version (e.g. uname -a)

[normanmaurer]

No… 3.x is end of Life forever

Am 09.11.2019 um 01:20 schrieb Moncef Ben-Soula [e-mail]:

Question, will / could there be fix for the 3.10.6 version coming out as well?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[fabianedl777]

Hi,

I am using spring webflux 2.2.2.RELEASE with netty 4.1.43.Final, in an application that has 2 instances and is deployed in kubernetes and I have found this vulnerability when the TE is the first header and this header has a blank before the header name for example [space] Transfer-Encoding: chunked; reviewing the source code on the next line https://github.com/netty/netty/blob/8494b046ec7e4f28dbd44bc699cc4c4c92251729/codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java#L766 , blanks at the beginning of the header are excluded and for this reason the request continues and the vulnerability is subsequently presented; I ran this test on Akka Http and in this scenario he sends a 400 mentioning that the header name has an invalid name.

Thank you