CVE-2024-1135: Gunicorn HTTP Request Smuggling Vulnerability

CVE-2024-1135 Overview

CVE-2024-1135 is an HTTP Request Smuggling (HRS) vulnerability in Gunicorn, a popular Python WSGI HTTP server. The vulnerability arises from Gunicorn's failure to properly validate Transfer-Encoding headers. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.

Critical Impact

Attackers can exploit this vulnerability to bypass security controls, poison web caches, manipulate user sessions, and expose sensitive data by smuggling malicious HTTP requests through vulnerable Gunicorn servers.

Affected Products

• Gunicorn (Python WSGI HTTP Server)
• Systems running Gunicorn behind reverse proxies or load balancers
• Web applications deployed with affected Gunicorn versions

Discovery Timeline

• 2024-04-16 - CVE-2024-1135 published to NVD
• 2024-12-20 - Last updated in NVD database

Technical Details for CVE-2024-1135

Vulnerability Analysis

This vulnerability stems from improper handling of the Transfer-Encoding HTTP header in Gunicorn's request parsing logic. HTTP Request Smuggling occurs when a front-end server (such as a reverse proxy or load balancer) and a back-end server interpret HTTP request boundaries differently. In this case, Gunicorn incorrectly processes requests containing multiple, conflicting Transfer-Encoding headers by treating them as chunked regardless of the final encoding specified.

The core issue lies in how Gunicorn parses the Transfer-Encoding header when multiple values are present. Rather than rejecting ambiguous requests or properly validating the header chain, Gunicorn makes assumptions about the encoding that may differ from how front-end servers interpret the same request. This desynchronization creates an opportunity for attackers to "smuggle" a second request within what the front-end perceives as a single request body.

The vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests), which addresses scenarios where HTTP request interpretation differences between components create security gaps.

Root Cause

The root cause is Gunicorn's inconsistent handling of Transfer-Encoding headers. When processing HTTP requests with multiple or malformed Transfer-Encoding headers, Gunicorn defaults to treating the request body as chunked encoded without proper validation. This behavior diverges from RFC 7230 specifications, which require servers to either properly handle or reject ambiguous Transfer-Encoding headers. The discrepancy between how Gunicorn and front-end proxies interpret these headers creates the request smuggling opportunity.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to a web application served by Gunicorn behind a reverse proxy. The attack works by constructing requests with conflicting Transfer-Encoding headers that cause the front-end proxy and Gunicorn to disagree on where one request ends and the next begins.

A typical exploitation scenario involves:

1. The attacker sends a request with multiple or malformed Transfer-Encoding headers
2. The front-end proxy interprets the request boundaries differently than Gunicorn
3. A "smuggled" request hidden within the first request's body is processed as a separate request by Gunicorn
4. This smuggled request can target restricted endpoints, poison caches, or hijack other users' sessions

For detailed technical analysis and proof-of-concept information, refer to the Huntr Bounty Report.

Detection Methods for CVE-2024-1135

Indicators of Compromise

• Unusual HTTP requests with multiple or malformed Transfer-Encoding headers in access logs
• Unexpected access to restricted endpoints without proper authentication
• Cache entries containing unexpected or malicious content
• Session anomalies where users experience actions they did not perform
• Discrepancies between front-end proxy logs and Gunicorn application logs

Detection Strategies

• Implement HTTP request parsing validation at the WAF level to detect and block requests with conflicting Transfer-Encoding headers
• Monitor application logs for unusual request patterns or access to restricted resources
• Deploy network intrusion detection signatures to identify HTTP request smuggling attempts
• Audit web cache contents for unexpected or poisoned entries

Monitoring Recommendations

• Enable detailed logging on both front-end proxies and Gunicorn instances to identify request interpretation discrepancies
• Configure alerting for requests containing multiple Transfer-Encoding headers
• Monitor for unusual patterns in HTTP response timing that may indicate successful smuggling attacks
• Implement log correlation between front-end proxies and back-end servers to detect desynchronization

How to Mitigate CVE-2024-1135

Immediate Actions Required

• Update Gunicorn to the latest patched version that addresses the Transfer-Encoding header validation issue
• Configure front-end proxies to normalize or reject requests with ambiguous Transfer-Encoding headers
• Review and audit web application access logs for potential exploitation attempts
• Implement strict HTTP request validation at the WAF or reverse proxy layer

Patch Information

Consult the Debian LTS Security Announcement and the Debian LTS Security Update for distribution-specific patch information. For the latest security fixes, update Gunicorn using your package manager or pip to the most recent stable release.

Workarounds

• Configure your reverse proxy or load balancer to reject requests containing multiple or malformed Transfer-Encoding headers
• Implement strict HTTP/1.1 compliance validation at the front-end proxy level
• Consider upgrading to HTTP/2 end-to-end where possible, as HTTP/2 uses a different framing mechanism not susceptible to traditional request smuggling
• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block HTTP request smuggling attempts

# Example nginx configuration to reject ambiguous Transfer-Encoding headers
# Add to your nginx server block configuration

# Reject requests with multiple Transfer-Encoding headers
if ($http_transfer_encoding ~* ".*,.*") {
    return 400;
}

# Ensure proper proxy header handling
proxy_http_version 1.1;
proxy_set_header Connection "";