CVE-2022-1705

What it actually does

The net/http client in affected Go versions improperly validates certain Transfer-Encoding headers. When this client is used behind a reverse proxy or load balancer that also has lenient parsing, it can lead to HTTP Request Smuggling. This allows an attacker to desynchronize the connection between the front-end and back-end servers, causing a malicious request to be prepended to a legitimate user's subsequent request. This can result in cache poisoning, session hijacking, and bypassing of front-end security controls.

Why it matters to the business

This vulnerability can allow an attacker to impersonate legitimate users, leading to unauthorized access to sensitive data and account takeover. Successful exploitation can result in data breaches, reputational damage, and loss of customer trust. Given the widespread use of Go for backend services and microservices, many applications could be at risk if they operate behind common proxy servers.

How an attack unfolds

An attacker sends a specially crafted HTTP request to a front-end proxy server that sits in front of a vulnerable Go application. The request contains a malformed `Transfer-Encoding` header that is interpreted differently by the proxy and the Go backend. This discrepancy in parsing causes the proxy to forward a request that the Go application sees as incomplete. The leftover part of the attacker's request body, which is a second, malicious HTTP request, is left in the TCP connection buffer. When the next legitimate user's request arrives on the same connection, the backend server prepends the attacker's smuggled request to it, processing the combined malicious request using the victim's session credentials.

How to fix it

To remediate this vulnerability, upgrade Go to version 1.17.12 or 1.18.4, or a newer version. After updating the Go toolchain, you must recompile and redeploy all affected applications. If using Go modules, run `go get -u` and `go mod tidy` to ensure the patched standard library is used in the build.

How to confirm the fix worked

To validate the fix, ensure that all Go applications have been rebuilt using a patched Go compiler (1.17.12+, 1.18.4+). You can verify the version used for compilation by checking `go version` in the build environment or inspecting build logs and artifacts. To test for the vulnerability, use a web vulnerability scanner or manual penetration testing techniques to send requests with ambiguous `Transfer-Encoding` headers (e.g., `Transfer-Encoding: chunked, chunked`) and observe if a desynchronization between the proxy and backend can be achieved.

Typical attack path

1. The attacker identifies a target architecture where a vulnerable Go application acts as an HTTP client behind a reverse proxy.
2. The attacker crafts a single HTTP request containing a malformed `Transfer-Encoding` header and a second, embedded request intended for the backend.
3. The request is sent to the front-end proxy, which misinterprets the request boundaries and forwards a modified version to the Go application.
4. The Go application also misinterprets the request, processing the first part and leaving the attacker's embedded request in the network buffer.
5. A legitimate user's request is routed through the same backend connection.
6. The backend server reads the attacker's malicious request from the buffer and prepends it to the legitimate user's request.
7. The server executes the attacker's request with the victim's privileges, leading to session hijacking or other unauthorized actions.

How to detect it

Detecting exploitation requires correlating logs from front-end proxies/load balancers and the backend Go applications. Look for discrepancies in request counts, sizes, or content for the same connection. Specifically, search for HTTP requests containing unusual or malformed `Transfer-Encoding` headers, multiple `Transfer-Encoding` headers, or a combination of `Transfer-Encoding` and `Content-Length` headers. A significant indicator is a log entry on the backend that does not have a corresponding, well-formed entry on the front-end proxy.

• Transfer-Encoding: chunked, chunked
• Transfer-Encoding: chunked\r\nTransfer-Encoding: identity
• Requests containing both Content-Length and Transfer-Encoding headers

What your security team should do

• Immediately identify all applications built with Go and prioritize upgrading them to a patched version (1.17.12+ or 1.18.4+), followed by a full redeployment.
• As a defense-in-depth measure, review the configurations of all front-end proxies and load balancers to ensure they enforce strict HTTP protocol compliance and reject requests with ambiguous or invalid headers.
• Scan public-facing applications for HTTP Request Smuggling vulnerabilities, as this flaw depends on the interaction between two systems.