SERVER-90260: Patched Fix Inconsistent Interpretation of HTTP Requests Smuggling

[imhunterand]

Description Summary

Affected of this project mongodb/mongo are vulnerable to HTTP Request Smuggling in the twisted.web.http module which makes non-conformant parsing and can lead to desync if requests pass through multiple HTTP parsers. Note: To be vulnerable, applications need to both use Twisted Web's HTTP server/proxy, along with some other HTTP server/proxy.

      endOfLengthIndex = self._buffer.find(b";", 0, eolIndex)
        if endOfLengthIndex == -1:
            endOfLengthIndex = eolIndex
        try:
            length = int(self._buffer[0:endOfLengthIndex], 16)
        except ValueError:
            raise _MalformedChunkedDataError("Chunk-size must be an integer.")

        if length < 0:
            raise _MalformedChunkedDataError("Chunk-size must not be negative.")
        elif length == 0:

        self.assertEqual(
            request.requestHeaders.getRawHeaders(b"spaces"),
            [b"spaces   spaces    spaces"],
        )
        self.assertEqual(
            request.requestHeaders.getRawHeaders(b"tab"),
            [b"t \ta \tb"],

Impact

The specifics of the other HTTP parser matter. The original report notes that some versions of Apache Traffic Server and HAProxy have been vulnerable in the past. HTTP request smuggling may be a serious concern if you use a proxy to perform request validation or access control.

CVE-2022-24801
CWE-444
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

[kelly-cs]

Thanks for making this pull request! We just need a couple of things from you to start our consideration of the PR. Can you please:

1. Sign our Contributor's Agreement.

2. Create a new SERVER ticket on JIRA.

[kelly-cs]

https://jira.mongodb.org/browse/SERVER-90260

[imhunterand]

Hi @kelly-cs,

I see the ticket you created SERVER-90260 is not found. could you please check the ticket? I cannot find it.