CVE-2024-23316: PingAccess Request Smuggling Vulnerability

CVE-2024-23316 Overview

CVE-2024-23316 is an HTTP request smuggling vulnerability affecting Ping Identity PingAccess versions prior to 8.0.1. The flaw exists in how PingAccess parses inconsistent HTTP header fields, causing front-end and back-end servers to disagree on request boundaries. An attacker can send specially crafted HTTP headers to desynchronize the proxy chain and smuggle a second request through proxied connections. Successful exploitation can lead to cache poisoning, credential theft, bypass of access controls, and exposure of sensitive data served behind the access gateway. The vulnerability is classified as [CWE-444] Inconsistent Interpretation of HTTP Requests.

Critical Impact
Attackers can smuggle unauthorized HTTP requests through PingAccess to bypass security policies, hijack sessions, and access protected back-end resources without authentication.

Affected Products

Ping Identity PingAccess, all versions prior to 8.0.1
Deployments using PingAccess as a reverse proxy or API gateway
Environments where PingAccess fronts HTTP/1.1 back-end services

Discovery Timeline

2024-05-31 - CVE-2024-23316 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23316

Vulnerability Analysis

The vulnerability is an HTTP request smuggling condition (HTTP desync) in the request parsing path of PingAccess. When PingAccess acts as an intermediary, it forwards requests to upstream origin servers. If the front-end and back-end disagree on the length of a request body, an attacker can prepend a hidden second request to the back-end's input stream.

Smuggled requests are processed in the context of the next legitimate client's connection. This enables attackers to inject arbitrary requests, poison shared response queues, and exfiltrate headers belonging to other users. Because PingAccess enforces authentication and authorization policies, desynchronization can effectively bypass those controls for the smuggled payload.

The EPSS exploit-likelihood data places this issue in the moderate range for opportunistic targeting against internet-exposed gateways. No public exploit code or CISA KEV listing exists at this time.

Root Cause

The root cause is inconsistent interpretation of HTTP framing headers, specifically conflicting Content-Length and Transfer-Encoding values, or malformed chunked encoding. PingAccess and the upstream server disagree on where one request ends and the next begins, producing the desynchronization state required for smuggling.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP/1.1 request containing ambiguous framing headers to the PingAccess listener. The proxy forwards what it considers a single request, while the back-end interprets the trailing bytes as the start of a new request. The attacker's smuggled request is then prepended to a victim's subsequent request, allowing response queue poisoning, header capture, or policy bypass.

The vulnerability manifests during request boundary parsing inside the proxy engine. Refer to the Ping Identity Security Advisory for vendor technical details.

Detection Methods for CVE-2024-23316

Indicators of Compromise

HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers reaching the PingAccess listener.
Malformed chunked encoding, oversized header values, or duplicated framing headers in proxy access logs.
Unexpected back-end requests with no matching front-end client identifier or session.
Anomalous response-to-request pairings where users receive content belonging to other sessions.

Detection Strategies

Inspect PingAccess and upstream web server logs for paired ambiguous framing headers on the same request.
Deploy a web application firewall rule that rejects requests presenting conflicting Content-Length and Transfer-Encoding headers.
Correlate HTTP 400/502 spikes on upstream services with request volume changes at the PingAccess tier.

Monitoring Recommendations

Forward PingAccess access and audit logs to a centralized SIEM for header-anomaly analytics.
Alert on repeated requests from the same source containing non-standard Transfer-Encoding values such as chunked, identity or whitespace-obfuscated variants.
Track session token reuse across distinct source IP addresses, which can indicate captured headers from smuggled responses.

How to Mitigate CVE-2024-23316

Immediate Actions Required

Upgrade PingAccess to version 8.0.1 or later on all proxy nodes.
Audit upstream applications behind PingAccess for cached responses that may have been poisoned during the exposure window.
Rotate session tokens and API keys that traversed affected PingAccess deployments.
Review reverse-proxy and load-balancer chains for additional intermediaries that may amplify smuggling.

Patch Information

Ping Identity released the fix in PingAccess 8.0.1. Patch artifacts and release notes are available on the Ping Identity Release Notes and the Ping Identity Download Page. Apply the upgrade across all clustered PingAccess engines and administrative nodes simultaneously to avoid version skew.

Workarounds

Place a strict HTTP/1.1 validating proxy or WAF in front of PingAccess to normalize or reject ambiguous framing headers.
Disable HTTP/1.1 keep-alive on upstream connections where business requirements permit, reducing the window for smuggling.
Restrict network access to PingAccess listeners to known client ranges until patching is complete.

bash

# Example WAF rule (ModSecurity) to block conflicting framing headers
SecRule REQUEST_HEADERS:Content-Length "@rx ." \
  "id:1002316,phase:1,deny,status:400,\
   chain,msg:'CVE-2024-23316 HTTP smuggling attempt'"
  SecRule REQUEST_HEADERS:Transfer-Encoding "@rx chunked" "t:lowercase"