HexBrain
Open on HackerOneSign in

Internet Bug Bounty · Report #1630669

CVE-2022-32214 - HTTP Request Smuggling Due To Improper Delimiting of Header Fields

Validstatus
mediumseverity
$1,800bounty
11upvotes
22 Jul 2022disclosed

Summary

HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214)

The llhttp parser in the http module does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

More details will be available at CVE-2022-32214 after publication.

Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.

Impacts:

All versions of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js

Security Advisory: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

How it was found

Original Report: https://hackerone.com/reports/1524692

Impact

Depending on the specific web application, HRS can lead to cache poisoning, bypassing of security layers, stealing of credentials and so on.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original