GHSA-mgc4-wqv7-4pxm SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
Attackers can exploit HTTP request smuggling via malformed headers to bypass authentication or routing controls in applications using SwiftNIO.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-mgc4-wqv7-4pxm?
GHSA-mgc4-wqv7-4pxm is a vulnerability in github.com/apple/swift-nio, published on 18 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.
This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the NIOHTTP1 module.
Workarounds
No workaround is available, users must upgrade.
References
Which versions are affected by GHSA-mgc4-wqv7-4pxm?
4 open source packages ship an affected version, including github.com/apple/swift-nio.
| Package | Affected | Fixed in |
|---|---|---|
github.com/apple/swift-nio SwiftURL | From 1.0.0 | 1.14.2 |
github.com/apple/swift-nio SwiftURL | From 1.0.0 | 1.14.2 |
github.com/apple/swift-nio SwiftURL | From 2.0.0 | 2.13.1 |
github.com/apple/swift-nio SwiftURL | From 2.0.0 | 2.13.1 |
How do I fix GHSA-mgc4-wqv7-4pxm?
Upgrade github.com/apple/swift-nio to a fixed version for your release line: 1.14.2 or 2.13.1.
Is GHSA-mgc4-wqv7-4pxm being exploited?
There is no known exploitation of GHSA-mgc4-wqv7-4pxm in the wild and no public exploit code.