CVE-2022-45060 in Cache
Summary
by MITRE • 11/09/2022
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/17/2024
The vulnerability identified as CVE-2022-45060 represents a critical HTTP request forgery flaw within Varnish Cache versions 5.x through 7.2.x prior to their respective security patches. This issue specifically affects the handling of HTTP/2 pseudo-headers when they are translated into HTTP/1 request lines for backend communication, creating a pathway for attackers to manipulate the request structure. The vulnerability stems from the improper sanitization of HTTP/2 pseudo-headers that contain characters invalid in HTTP/1 contexts, allowing malicious actors to inject malformed request components that bypass normal validation mechanisms. This flaw exists in the core request processing pipeline where Varnish translates incoming HTTP/2 requests into HTTP/1 format for backend servers, creating a direct attack vector through the proxy layer.
The technical implementation of this vulnerability occurs at the protocol translation layer within Varnish Cache's request handling architecture. When HTTP/2 requests arrive, the system processes pseudo-headers such as :method, :authority, :path, and :scheme, which contain information that must be properly mapped to HTTP/1 request line components. The flaw manifests when these pseudo-headers contain characters or values that are syntactically invalid within HTTP/1 request lines, yet the translation process fails to properly validate or sanitize these inputs before forwarding to backend servers. This creates a condition where an attacker can craft HTTP/2 requests containing malicious pseudo-header values that translate into malformed HTTP/1 requests, potentially bypassing security controls that only inspect the HTTP/1 request structure. The vulnerability operates under CWE-345 Insufficient Verification of Data Authenticity, as the system fails to verify that translated request components maintain valid HTTP/1 syntax.
The operational impact of this vulnerability extends beyond simple request manipulation, as it can be leveraged to exploit backend server vulnerabilities that are typically protected by the Varnish proxy layer. Attackers can potentially inject characters that cause backend servers to interpret requests differently than intended, potentially triggering buffer overflows, injection attacks, or other vulnerabilities that would normally be mitigated by proper proxy filtering. The attack scenario involves crafting HTTP/2 requests with malicious pseudo-headers that, when translated, create invalid HTTP/1 requests which may be processed by backend servers with different security assumptions than those in the Varnish layer. This creates a potential for privilege escalation, data exfiltration, or service disruption depending on the backend server configuration and the specific vulnerabilities present in the downstream systems. The vulnerability is particularly concerning in environments where Varnish serves as a security boundary between external clients and internal backend services, as it essentially allows bypassing the proxy's security controls.
Mitigation strategies for CVE-2022-45060 require immediate patching of affected Varnish Cache versions to the recommended secure releases including 6.0.11, 7.1.2, and 7.2.1 respectively. Organizations should also implement additional monitoring for unusual request patterns that might indicate exploitation attempts, particularly focusing on backend server logs for malformed requests that could result from the translation process. Network-level controls such as HTTP request filtering rules and content inspection can help detect and block malformed requests before they reach backend servers, though these measures are secondary to proper patching. The vulnerability aligns with ATT&CK technique T1190 Exploit Public-Facing Application, as it represents an exploitation of a publicly known vulnerability in a widely deployed web application proxy. Organizations should also consider implementing more robust input validation at the Varnish level to prevent invalid characters from being passed through to backend systems, and establish comprehensive testing procedures to validate request translation integrity in environments where HTTP/2 to HTTP/1 translation occurs.