netius up to 1.17.57 Header Parsing HTTP Request request smuggling

Summaryinfo

A vulnerability labeled as critical has been found in netius up to 1.17.57. The impacted element is an unknown function of the component Header Parsing. Executing a manipulation as part of HTTP Request can lead to request smuggling. This vulnerability is handled as CVE-2020-7655. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in netius up to 1.17.57. It has been declared as critical. This vulnerability affects an unknown part of the component Header Parsing. The manipulation as part of a HTTP Request leads to a request smuggling vulnerability. The CWE definition for the vulnerability is CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.

The weakness was released 05/21/2020. This vulnerability was named CVE-2020-7655 since 01/21/2020. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.17.58 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• netius

Version

• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.17.4
• 1.17.5
• 1.17.6
• 1.17.7
• 1.17.8
• 1.17.9
• 1.17.10
• 1.17.11
• 1.17.12
• 1.17.13
• 1.17.14
• 1.17.15
• 1.17.16
• 1.17.17
• 1.17.18
• 1.17.19
• 1.17.20
• 1.17.21
• 1.17.22
• 1.17.23
• 1.17.24
• 1.17.25
• 1.17.26
• 1.17.27
• 1.17.28
• 1.17.29
• 1.17.30
• 1.17.31
• 1.17.32
• 1.17.33
• 1.17.34
• 1.17.35
• 1.17.36
• 1.17.37
• 1.17.38
• 1.17.39
• 1.17.40
• 1.17.41
• 1.17.42
• 1.17.43
• 1.17.44
• 1.17.45
• 1.17.46
• 1.17.47
• 1.17.48
• 1.17.49
• 1.17.50
• 1.17.51
• 1.17.52
• 1.17.53
• 1.17.54
• 1.17.55
• 1.17.56
• 1.17.57

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion