CVE-2021-39214 Lacking Protection against HTTP Request Smuggling in mitmproxy
Attackers can smuggle HTTP requests through mitmproxy, bypassing custom access controls and input sanitization implemented in event hooks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39214?
CVE-2021-39214 is a high-severity vulnerability in mitmproxy, published on 16 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless one uses mitmproxy to protect an HTTP/1 service, no action is required. The vulnerability has been fixed in mitmproxy 7.0.3 and above.
Weakness: CWE-444
Which versions are affected by CVE-2021-39214?
3 open source packages ship an affected version, including mitmproxy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mitmproxy PyPI | All versions | 7.0.3 |
mitmproxy PyPI | All versions | 7.0.3 |
mitmproxy PyPI | All versions | 7.0.3 |
Linux distribution packages (4)
python-mitmproxy SUSE:Package Hub 15 SP4 | All versions | 3.0.4-bp154.2.3.1 |
python-mitmproxy SUSE:Package Hub 15 SP5 | All versions | 3.0.4-bp155.3.3.1 |
python-mitmproxy openSUSE:Leap 15.4 | All versions | 3.0.4-bp154.2.3.1 |
python-mitmproxy openSUSE:Leap 15.5 | All versions | 3.0.4-bp155.3.3.1 |
Products include Mitmproxy Mitmproxy.
How do I fix CVE-2021-39214?
Upgrade mitmproxy to 7.0.3 or later.
Is CVE-2021-39214 being exploited?
There is no known exploitation of CVE-2021-39214 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in mitmproxy
Sources
Also known as DEBIAN-CVE-2021-39214, GHSA-22gh-3r9q-xf38, PYSEC-2021-328, UBUNTU-CVE-2021-39214, openSUSE-SU-2023:0232-1, openSUSE-SU-2023:0233-1.