CVE-2022-41915: Netty HTTP Response Splitting Vulnerability

CVE-2022-41915 Overview

CVE-2022-41915 is an HTTP Response Splitting vulnerability in the Netty project, an event-driven asynchronous network application framework. The flaw exists in versions 4.1.83.Final through 4.1.85.Final, where calling DefaultHttpHeaders.set with an iterator of values bypasses header value validation. This allows attackers to inject malicious header values that can manipulate HTTP responses, potentially leading to cache poisoning, session hijacking, or cross-site scripting attacks.

Critical Impact

Attackers can exploit this vulnerability to perform HTTP Response Splitting attacks, enabling injection of arbitrary HTTP headers and potentially compromising application security through cache poisoning or XSS attacks.

Affected Products

• Netty versions 4.1.83.Final to 4.1.85.Final
• Debian Linux 10.0
• Debian Linux 11.0

Discovery Timeline

• 2022-12-13 - CVE-2022-41915 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-41915

Vulnerability Analysis

The vulnerability resides in Netty's DefaultHttpHeaders class, specifically within the set(CharSequence, Iterator<?>) method. When header values are provided via an iterator, the framework fails to validate each value before adding it to the headers collection. This validation gap allows malicious input containing carriage return (CR) and line feed (LF) characters to pass through unchecked.

HTTP Response Splitting exploits occur when an attacker can inject CRLF sequences into HTTP headers. These sequences act as header delimiters, allowing the attacker to terminate the current header prematurely and inject additional headers or even an entirely new HTTP response body. The vulnerability is classified under CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers) and CWE-436 (Interpretation Conflict).

Root Cause

The root cause lies in the inconsistent application of input validation within the DefaultHeaders.java class. While other methods properly validate header values through the validateValue() function, the iterator-based set() method directly called add0() without first validating the converted value. This oversight created a bypass where malicious values could circumvent the framework's security controls.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication. An attacker who can control HTTP header values passed through an iterator to DefaultHttpHeaders.set() can inject CRLF sequences to split HTTP responses. This attack vector enables various secondary attacks including:

• Cache Poisoning: Injecting malicious content into web caches
• Session Hijacking: Setting arbitrary cookies or session tokens
• Cross-Site Scripting: Injecting script content through response manipulation
• Redirect Attacks: Forcing redirects to malicious sites

The security patch adds proper validation by calling validateValue() before adding header values:

             if (v == null) {
                 break;
             }
-            add0(h, i, name, fromObject(name, v));
+            V converted = fromObject(name, v);
+            validateValue(valueValidator, name, converted);
+            add0(h, i, name, converted);
         }
 
         return thisT();

Source: GitHub Commit Details

Detection Methods for CVE-2022-41915

Indicators of Compromise

• HTTP requests or responses containing unexpected CRLF sequences (%0d%0a or \r\n) in header values
• Abnormal HTTP response structures with injected headers or duplicate response bodies
• Log entries showing malformed HTTP headers being processed by Netty-based applications
• Cache entries with unexpected content that differs from origin server responses

Detection Strategies

• Monitor application logs for HTTP parsing errors or malformed header exceptions
• Implement Web Application Firewall (WAF) rules to detect CRLF injection attempts in HTTP headers
• Review code for usage patterns of DefaultHttpHeaders.set() with iterator parameters
• Scan dependencies using software composition analysis tools to identify vulnerable Netty versions

Monitoring Recommendations

• Enable detailed HTTP logging on reverse proxies and load balancers to capture header anomalies
• Configure intrusion detection systems to alert on CRLF patterns in HTTP traffic
• Monitor cache hit ratios for unexpected variations that could indicate poisoning attempts
• Review application behavior for signs of session manipulation or unauthorized redirects

How to Mitigate CVE-2022-41915

Immediate Actions Required

• Upgrade Netty to version 4.1.86.Final or later immediately
• Audit application code for usage of DefaultHttpHeaders.set(CharSequence, Iterator<?>) method
• Implement input validation at the application layer for any user-controlled data that becomes HTTP headers
• Review downstream systems and caches for potential poisoning from prior exploitation

Patch Information

The vulnerability has been patched in Netty version 4.1.86.Final. The fix ensures that all header values, including those provided via iterators, are validated through the validateValue() function before being added to the headers collection. Detailed patch information is available in the GitHub Security Advisory and the GitHub Pull Request.

For Debian Linux users, security updates are available through DSA-5316 and the Debian LTS announcement.

Workarounds

• Replace DefaultHttpHeaders.set(CharSequence, Iterator<?>) calls with a combination of remove() followed by add() in a loop
• Implement custom validation to strip or reject header values containing CR/LF characters before passing to Netty
• Deploy a reverse proxy or WAF in front of affected applications to filter malicious header values

# Verify Netty version in Maven projects
mvn dependency:tree | grep netty

# Update Netty dependency in pom.xml to patched version
# Change: <version>4.1.83.Final</version>
# To: <version>4.1.86.Final</version>

# For Gradle projects, check dependencies
./gradlew dependencies | grep netty