CVE-2024-42342: Loway QueueMetrics HTTP Smuggling Flaw

CVE-2024-42342 Overview

CVE-2024-42342 is an HTTP Request Smuggling vulnerability affecting Loway QueueMetrics, a call center monitoring and reporting platform for Asterisk PBX systems. The flaw stems from inconsistent interpretation of HTTP requests between intermediary servers and the QueueMetrics backend, classified under [CWE-444]. An attacker can craft ambiguous HTTP requests that front-end proxies and back-end servers parse differently. Successful exploitation allows limited integrity impact and requires user interaction over the network.

Critical Impact
Attackers can smuggle malicious HTTP requests past front-end security controls, potentially bypassing access restrictions or poisoning cached responses served to legitimate QueueMetrics users.

Affected Products

Loway QueueMetrics (all versions prior to vendor fix)

Discovery Timeline

2024-09-08 - CVE-2024-42342 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42342

Vulnerability Analysis

The vulnerability resides in how Loway QueueMetrics processes and interprets HTTP request headers. When a front-end proxy and the QueueMetrics application disagree on request boundaries, an attacker can embed a second, hidden request inside the body of a first request. The backend then processes this smuggled request as if it originated from a separate client.

Exploitation requires network access and user interaction, typically luring an authenticated user to trigger the initial malicious request. The impact is limited to integrity, meaning attackers can modify or inject request data but cannot directly extract confidential information or disrupt availability through this flaw alone.

Root Cause

The root cause is inconsistent parsing of HTTP framing headers such as Content-Length and Transfer-Encoding between intermediate infrastructure and the QueueMetrics application server. When these two components disagree on where one request ends and the next begins, request boundaries desynchronize. This desynchronization is the defining characteristic of [CWE-444] Inconsistent Interpretation of HTTP Requests.

Attack Vector

Attackers deliver crafted HTTP requests over the network to a QueueMetrics deployment fronted by a reverse proxy or load balancer. The request contains conflicting or ambiguous framing headers designed to be interpreted one way by the proxy and another way by the backend. When a legitimate user's request follows the smuggled payload, the smuggled content prepends or interferes with the victim's request. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Israeli Government CVE Advisories for additional technical context on this issue.

Detection Methods for CVE-2024-42342

Indicators of Compromise

HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers directed at QueueMetrics endpoints.
Anomalous request sequences where response bodies appear misaligned with client requests in proxy access logs.
Unexpected authenticated actions in QueueMetrics audit logs that do not correspond to legitimate user sessions.

Detection Strategies

Inspect reverse proxy and web application firewall (WAF) logs for requests with conflicting framing headers.
Correlate front-end proxy logs with QueueMetrics application logs to identify request boundary mismatches.
Deploy WAF rules that normalize or reject requests containing ambiguous Content-Length and Transfer-Encoding combinations.

Monitoring Recommendations

Enable verbose HTTP request logging on both the proxy tier and the QueueMetrics application server.
Alert on HTTP 400-series responses spikes originating from the backend, which may indicate desync attempts.
Monitor authenticated user sessions for actions performed outside normal usage patterns or hours.

How to Mitigate CVE-2024-42342

Immediate Actions Required

Upgrade Loway QueueMetrics to the latest vendor-supplied version that addresses CVE-2024-42342.
Audit the reverse proxy configuration to ensure strict HTTP parsing behavior aligns with the QueueMetrics backend.
Restrict administrative access to QueueMetrics to trusted networks and authenticated users only.

Patch Information

Loway has not published a public advisory URL in the NVD entry. Contact Loway directly for the fixed QueueMetrics build and consult the Israeli Government CVE Advisories for guidance. Apply the vendor-supplied update as soon as it is available in your environment.

Workarounds

Configure the front-end proxy to reject requests containing both Content-Length and Transfer-Encoding headers.
Enable HTTP/2 end-to-end between the proxy and QueueMetrics where supported, as HTTP/2 framing eliminates most smuggling primitives.
Deploy a WAF with request smuggling protections in front of QueueMetrics until patching is complete.

bash

# Example nginx configuration to reject ambiguous framing
if ($http_transfer_encoding ~* "chunked") {
    set $ambiguous "1";
}
if ($http_content_length) {
    set $ambiguous "${ambiguous}1";
}
if ($ambiguous = "11") {
    return 400;
}