http4s Ember Request Smuggling via Case-Insensitive Transfer-Encoding (CWE-444)

Summary of Critical Vulnerability Information Vulnerability Overview Vulnerability Name: Ember Transfer-Encoding Value Parsing (TE.CL / TE.0 Request Smuggling) Vulnerability Type: HTTP Request Smuggling Severity: High (CVSS v3.1 Score 8.7/10) Root Cause: Ember's HTTP/1.1 header parser performs case-insensitive matching on the value of the header ( , which RFC 9112 §7 requires case-insensitive comparison). When a request carries (uppercase C), Ember falls back to handling based on (or 0 or absent), while the intermediate layer processes it as chunked encoding. This causes a divergence between the two regarding the end position of the request body, resulting in request smuggling. Affected Scope Affected Scenarios: - Server-side: When ember-server acts as the origin server located behind an intermediate layer, and the intermediate layer processes in a case-insensitive manner per RFC, a malicious or compromised upstream (client) can trigger request smuggling. - Client-side: ember-client shares the same on the response path. When http4s is used as a gateway, a malicious or compromised upstream can trigger response smuggling. Preconditions: - Unauthenticated remote attacker (server-side) - ember-server acts as the origin server behind an intermediate layer - The intermediate layer processes in a case-insensitive manner per RFC and does not lowercase the header value when forwarding - Malicious or compromised upstream (client-side) Remediation Version Upgrade: Upgrade to the fixed version (2.12 → ; 2.13/3 → ). Workarounds (Mitigations): - The intermediate layer buffers and re-encodes the request body (e.g., nginx default ) and lowercases the value before forwarding. - The intermediate layer normalizes the value (lowercases it). - Disable keep-alive between the intermediate layer and Ember. PoC / Exploit Code No PoC or exploit code blocks are included in the documentation.

Goal Reached Thanks to every supporter — we hit 100%!

http4s Ember Request Smuggling via Case-Insensitive Transfer-Encoding (CWE-444)

More from this source