CVE-2023-34037: VMware Horizon HTTP Smuggling Vulnerability

CVE-2023-34037 Overview

VMware Horizon Server contains an HTTP request smuggling vulnerability (CWE-444) that allows malicious actors with network access to perform HTTP smuggling attacks. This vulnerability enables attackers to exploit inconsistencies in how front-end and back-end servers interpret HTTP requests, potentially leading to cache poisoning, session hijacking, or bypassing security controls.

Critical Impact

Attackers with network access can exploit HTTP request smuggling to manipulate request routing, potentially bypassing security controls and gaining unauthorized access to protected resources.

Affected Products

• VMware Horizon Client 2006
• VMware Horizon Client 2012
• VMware Horizon Client 2103
• VMware Horizon Client 2106
• VMware Horizon Client 2111
• VMware Horizon Client 2111.1
• VMware Horizon Client 2203
• VMware Horizon Client 2212

Discovery Timeline

• August 4, 2023 - CVE-2023-34037 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-34037

Vulnerability Analysis

HTTP request smuggling vulnerabilities occur when front-end and back-end servers process HTTP requests differently, particularly in how they determine where one request ends and another begins. In the case of CVE-2023-34037, VMware Horizon Server exhibits inconsistent parsing of HTTP request boundaries, allowing attackers to inject malicious requests that bypass security controls.

The vulnerability stems from improper handling of HTTP request headers, specifically the Content-Length and Transfer-Encoding headers. When these headers are ambiguously interpreted between proxy servers and the Horizon Server backend, an attacker can craft requests that appear as one request to the front-end but are parsed as multiple requests by the back-end.

This attack vector requires only network access with no authentication or user interaction, making it accessible to remote attackers who can reach the vulnerable Horizon Server endpoint.

Root Cause

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests), where the Horizon Server's HTTP parsing logic does not properly validate and normalize incoming HTTP requests. This inconsistency between how the server handles request delimitation creates the smuggling opportunity. The vulnerability allows manipulation of request boundaries through malformed headers that are processed differently by intermediary servers versus the Horizon Server itself.

Attack Vector

The attack is executed over the network without requiring authentication or user interaction. An attacker would craft specially formed HTTP requests containing ambiguous Content-Length or Transfer-Encoding headers. These malformed requests exploit parsing differences to:

1. Smuggle additional HTTP requests past front-end security controls
2. Potentially poison web caches with malicious content
3. Hijack other users' requests by manipulating request routing
4. Bypass access controls by injecting authorized-looking requests

The vulnerability allows an attacker to manipulate request boundaries by exploiting differences in how HTTP/1.1 request delimiters are interpreted. A typical smuggling attack involves sending a request with conflicting Content-Length and Transfer-Encoding headers, causing the front-end and back-end to disagree on where requests begin and end.

Detection Methods for CVE-2023-34037

Indicators of Compromise

• Unusual HTTP requests with conflicting Content-Length and Transfer-Encoding headers in web server logs
• Multiple responses returned for single client requests, indicating request boundary manipulation
• Unexpected cache behavior or cache entries with malicious content
• HTTP responses that do not match expected request patterns

Detection Strategies

• Monitor HTTP traffic for requests containing both Content-Length and Transfer-Encoding: chunked headers simultaneously
• Implement deep packet inspection to detect malformed HTTP requests with ambiguous delimiters
• Review web application firewall (WAF) logs for blocked request smuggling attempts
• Deploy network-based intrusion detection rules targeting CWE-444 attack patterns

Monitoring Recommendations

• Enable detailed HTTP access logging on VMware Horizon Server and all front-end proxies
• Configure alerting for anomalous HTTP request patterns, particularly those with header inconsistencies
• Implement traffic analysis between proxy layers to identify request boundary discrepancies
• Monitor for increased 400-series HTTP errors that may indicate smuggling attempts

How to Mitigate CVE-2023-34037

Immediate Actions Required

• Upgrade VMware Horizon Client to the latest patched version as specified in the VMware security advisory
• Review and harden front-end proxy configurations to normalize HTTP requests before forwarding to Horizon Server
• Enable strict HTTP parsing modes on all intermediary servers and load balancers
• Implement WAF rules to block requests with ambiguous Content-Length and Transfer-Encoding combinations

Patch Information

VMware has released security updates to address this vulnerability. Refer to VMware Security Advisory VMSA-2023-0017 for detailed patch information and upgrade instructions. Organizations should prioritize patching all affected Horizon Client versions including 2006, 2012, 2103, 2106, 2111, 2111.1, 2203, and 2212.

Workarounds

• Configure front-end servers to reject requests containing both Content-Length and Transfer-Encoding headers
• Implement HTTP/2 end-to-end where possible, as it is not susceptible to traditional HTTP request smuggling
• Deploy a web application firewall with HTTP normalization capabilities in front of Horizon Server
• Ensure all servers in the request chain use identical HTTP parsing libraries and configurations

# Example: Configure nginx to reject ambiguous requests
# Add to nginx server configuration
proxy_http_version 1.1;
proxy_set_header Connection "";

# Reject requests with both Content-Length and Transfer-Encoding
if ($http_transfer_encoding ~* "chunked") {
    set $smuggle_check "TE";
}
if ($content_length != "") {
    set $smuggle_check "${smuggle_check}CL";
}
if ($smuggle_check = "TECL") {
    return 400;
}