Netty SOCKS4/5 Proxy Encoder Null Byte Injection and Credential Vulnerability

Vulnerability Overview Vulnerability Name: SOCKS4/5 Proxy Encoder Null Byte and Credential Injection Description: This vulnerability involves security issues in the SOCKS4/5 proxy encoder within the Netty library, resulting from improper handling of null bytes and input validation. Specifically, it includes: SOCKS5 Domain Null Byte Injection: SOCKS5 domain addresses are encoded as 1-byte length + domain string, but null bytes within the domain string are not validated. SOCKS5 Authentication Credential Injection: SOCKS5 password authentication (RFC 1929) uses 1-byte length + string for usernames and passwords, accepting null bytes and CRLF characters. SOCKS4 User ID Null Byte Truncation: SOCKS4 uses null-terminated strings for user IDs; embedded null bytes cause ambiguity in the protocol structure. SOCKS4a Domain Null Byte Truncation: SOCKS4a appends a null-terminated domain after the user ID; embedded null bytes similarly cause ambiguity. Impact Scope Product: Netty Versions: 4.2.12.Final and all prior versions (when used with codec-socks) Components: - - Vulnerability Types: CWE-626: Null Byte Injection Error / CWE-20: Improper Input Validation Impact: Domain name spoofing, SOCKS4 user ID truncation, authentication data injection CVSS 3.1 Score: 7.5 (High) CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Remediation Affected Versions: >=4.2.0.Final, <=4.2.16.Final; <=4.1.136.Final Fixed Versions: 4.2.17.Final; 4.1.137.Final Proof of Concept (POC) Code SOCKS5 Domain Null Byte Injection SOCKS5 Authentication Credential Injection SOCKS4 User ID Null Byte Truncation SOCKS4a Domain Null Byte Truncation Impact Analysis Domain Name Spoofing: Null byte truncation causes connection to instead of Authentication Bypass: Null bytes in usernames truncate them to shorter names, potentially matching different accounts Protocol Confusion: Additional null bytes in SOCKS4 packets create ambiguous protocol frames SSRF: Combined with domain name spoofing, this can redirect proxy connections to internal hosts References RFC 1928: SOCKS Protocol Version 5 RFC 1929: Username/Password Authentication for SOCKS V5 CWE-626: Null Byte Injection Error

Goal Reached Thanks to every supporter — we hit 100%!

Netty SOCKS4/5 Proxy Encoder Null Byte Injection and Credential Vulnerability

More from this source