CVE-2024-1135

CVSS V2 None CVSS V3 None

Description

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.

Overview

CVE ID
CVE-2024-1135

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-04-16T00:00:14.938Z

Last Modified Date
2024-06-04T17:59:56.871Z

Weakness Enumerations

CWE	URL
CWE-444	http://cwe.mitre.org/data/definitions/444.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-1135
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1135

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 06:24:23				Added to TrackCVE