CVE-2024-33452: Openresty Lua-nginx-module Smuggling Flaw

CVE-2024-33452 Overview

CVE-2024-33452 is an HTTP Request Smuggling vulnerability affecting OpenResty lua-nginx-module version 0.10.26 and earlier. The flaw allows a remote attacker to desynchronize the parsing of HTTP requests between front-end and back-end servers by sending a crafted HEAD request. Successful exploitation enables an attacker to smuggle a second request through the connection, bypass security controls, poison caches, and potentially access other users' sessions. The vulnerability is classified as [CWE-444] Inconsistent Interpretation of HTTP Requests.

Critical Impact

A remote, unauthenticated attacker can smuggle HTTP requests past front-end proxies, enabling security control bypass, cache poisoning, and unauthorized access to back-end resources processed by lua-nginx-module.

Affected Products

• OpenResty lua-nginx-module versions 0.10.26 and earlier
• Web stacks embedding OpenResty lua-nginx-module for request handling
• Debian LTS distributions packaging vulnerable lua-nginx-module builds

Discovery Timeline

• 2025-04-22 - CVE-2024-33452 published to the National Vulnerability Database
• 2025-06 - Debian LTS issued a security announcement covering the affected package
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-33452

Vulnerability Analysis

The vulnerability resides in how OpenResty lua-nginx-module parses and forwards HTTP HEAD requests. HTTP Request Smuggling (HRS) exploits inconsistencies between how chained HTTP processors interpret request boundaries. When a front-end proxy and a back-end lua-nginx-module instance disagree on where one request ends and the next begins, an attacker can prepend smuggled content to a victim's subsequent request.

In this case, a crafted HEAD request triggers desynchronization between the module and upstream or downstream HTTP parsers. Because HEAD responses must not contain a message body, mishandling of Content-Length or Transfer-Encoding semantics on HEAD requests is a known class of smuggling primitive. The result is that bytes intended as the body of one request are reinterpreted as the start of a new request by the next hop.

Attackers can leverage the desync to bypass authentication on internal endpoints, poison shared caches, hijack credentials sent on the same connection, and exfiltrate request data. The vulnerability requires no privileges and no user interaction. Successful exploitation requires meeting specific timing and proxy-chain conditions, which raises the attack complexity but does not prevent reliable exploitation against suitable targets.

Root Cause

The root cause is inconsistent interpretation of HTTP request framing for HEAD requests within lua-nginx-module prior to and including 0.10.26. The module does not normalize request boundary semantics in a way that matches strict HTTP/1.1 parsing rules used by upstream proxies. This mismatch is the defining characteristic of [CWE-444].

Attack Vector

The attack is conducted remotely over the network against any HTTP service that fronts or is fronted by lua-nginx-module. The attacker sends a single TCP connection containing a HEAD request crafted with manipulated Content-Length, Transfer-Encoding, or chunked-encoding headers. The trailing portion of the malicious request is then interpreted by the downstream parser as a new, attacker-controlled request that piggybacks onto a legitimate user's connection.

No authenticated session, configuration weakness, or user interaction is required. Public research from PortSwigger on HTTP Desync Attacks and the Benasin blog write-up of the OpenResty issue document the request structure required to trigger the desynchronization.

Detection Methods for CVE-2024-33452

Indicators of Compromise

• HEAD requests received with both Content-Length and Transfer-Encoding: chunked headers, or with conflicting Content-Length values
• HEAD requests followed by raw HTTP method tokens (GET, POST, PUT) embedded in the request body section on the same connection
• Unexpected upstream 400/502 responses correlated with HEAD requests from a single client IP
• Cache entries containing responses for URLs that the legitimate client never requested

Detection Strategies

• Inspect HTTP traffic for ambiguous framing on HEAD requests, specifically conflicting Content-Length and Transfer-Encoding headers, and reject or normalize at the edge
• Correlate access logs from front-end proxies and the lua-nginx-module back end to flag requests where the back end processed a different URI or method than the proxy logged
• Deploy web application firewall signatures targeting HTTP desync patterns documented in PortSwigger's HTTP Desync research

Monitoring Recommendations

• Enable verbose request logging on OpenResty workers, capturing raw request lines and header sets for HEAD traffic
• Alert on spikes in HEAD requests from single source IPs, especially with non-zero body lengths
• Monitor cache hit/miss anomalies that may indicate cache poisoning via smuggled requests

How to Mitigate CVE-2024-33452

Immediate Actions Required

• Inventory all systems running OpenResty lua-nginx-module and confirm versions; flag any at or below 0.10.26
• Upgrade lua-nginx-module to a version released after 0.10.26 that addresses the HEAD-request framing handling
• Apply the Debian LTS package update referenced in the Debian LTS Security Announcement for affected distributions
• Restart all nginx/OpenResty worker processes after patching to ensure new binaries are loaded

Patch Information

Upgrade OpenResty lua-nginx-module to a version later than 0.10.26. Debian LTS users should install the fixed package version distributed through the June 2025 LTS advisory. Confirm the deployed version with nginx -V and inspect the loaded module list to validate the upgrade.

Workarounds

• Configure the front-end proxy to strictly validate HTTP/1.1 framing and reject requests presenting both Content-Length and Transfer-Encoding headers
• Disable HTTP keep-alive on connections between the front-end proxy and lua-nginx-module to limit the impact of any desync
• Terminate HTTP/1.1 at a hardened reverse proxy and forward only HTTP/2 to the OpenResty back end where feasible
• Deploy WAF rules that block HEAD requests carrying a non-zero Content-Length or chunked body

# Verify installed lua-nginx-module version
nginx -V 2>&1 | tr ' ' '\n' | grep -i lua-nginx-module

# Example: reject ambiguous framing at the edge (nginx)
# Place inside the relevant server { } block
if ($http_transfer_encoding ~* chunked) {
    if ($http_content_length) {
        return 400;
    }
}