CVE-2022-45059 in Cache
Summary
by MITRE • 11/09/2022
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/17/2024
The vulnerability identified as CVE-2022-45059 represents a critical request smuggling flaw in Varnish Cache versions prior to 7.1.2 and 7.2.1, affecting the widely deployed HTTP caching system used by numerous organizations to improve web application performance. This security issue stems from improper handling of hop-by-hop headers within the caching mechanism, creating a pathway for malicious actors to manipulate HTTP request flows between clients and backend servers. The vulnerability specifically targets the HTTP protocol's header processing logic where certain headers should be stripped or modified during proxy operations to prevent interference between different network hops.
The technical flaw manifests when Varnish Cache servers fail to properly identify and process hop-by-hop headers as defined in RFC 2616 and subsequent HTTP specifications. This misconfiguration allows attackers to inject or modify headers that should be removed during proxy operations, enabling them to bypass normal request forwarding mechanisms. The vulnerability operates at the HTTP protocol layer where Varnish Cache's header processing logic does not adequately distinguish between headers that should be forwarded to backend servers versus those that should be consumed or removed during the proxy process. This creates a scenario where malicious requests can manipulate the caching layer to either forward or suppress critical headers, potentially leading to unauthorized access or data leakage.
The operational impact of this vulnerability extends beyond simple cache bypass scenarios, as it enables sophisticated attack patterns that can compromise the integrity of web applications protected by Varnish Cache. Attackers can exploit this weakness to perform request smuggling attacks where they manipulate how requests are processed through the caching layer, potentially allowing them to access backend resources that should be protected or to bypass authentication mechanisms. The vulnerability creates a persistent risk for organizations using affected Varnish Cache versions, as the attack surface remains active until the software is properly updated. This issue directly relates to CWE-444, which describes improper handling of HTTP requests, and aligns with ATT&CK technique T1592.001 for reconnaissance through information gathering, as attackers can use this vulnerability to map backend infrastructure and identify potential additional attack vectors.
Organizations should immediately implement mitigation strategies including updating to patched versions of Varnish Cache 7.1.2 or 7.2.1, depending on their current deployment. Additional protective measures include implementing strict header validation rules within proxy configurations, monitoring for unusual header patterns in access logs, and conducting thorough security assessments of caching infrastructure. Network segmentation and additional perimeter controls can provide defense-in-depth protection while updates are deployed. Security teams should also review existing configurations to ensure that hop-by-hop header handling is properly enforced and that no custom rules inadvertently allow the vulnerability to persist. The fix addresses the core issue by implementing proper header processing logic that correctly identifies and manages hop-by-hop headers according to HTTP specifications, preventing the smuggling attack vectors that were previously possible through the flawed implementation.