CVE-2021-32715 Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
Attackers can perform request smuggling or desync attacks by exploiting lenient Content-Length parsing in the hyper HTTP library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-32715?
CVE-2021-32715 is a low-severity vulnerability in hyperium hyper, published on 7 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.
Weakness: CWE-444
Which versions are affected by CVE-2021-32715?
3 open source packages ship an affected version, including hyper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hyper crates.io | All versions | 0.14.10 |
hyper crates.io | All versions | 0.14.10 |
hyper crates.io | From 0.0.0-0 | 0.14.10 |
Products include Hyper Hyper.
How do I fix CVE-2021-32715?
Upgrade hyper to 0.14.10 or later.
Is CVE-2021-32715 being exploited?
There is no known exploitation of CVE-2021-32715 in the wild and no public exploit code.
Other vulnerabilities in hyperium hyper
- CVE-2020-35863 HTTP Request Smuggling in hyper
- CVE-2022-31394 Denial of service in n/a
- CVE-2021-32714 Integer Overflow in Chunked Transfer-Encoding
- CVE-2017-18587 Headers containing newline characters can split messages in hyper
- CVE-2021-21299 Multiple Transfer-Encoding headers misinterprets request payload
Sources
Also known as DEBIAN-CVE-2021-32715, GHSA-f3pg-qwvg-p99c, RUSTSEC-2021-0078, UBUNTU-CVE-2021-32715.