In plain words
Imagine you are sending a package to someone, but you can hide an extra package inside the first one without the delivery person noticing. That is kind of like what this bug does, but with internet requests and responses. It is called a response smuggling vulnerability¹, which means an attacker can sneak extra data past security checks.
What's broken
The bug is in the Apache HTTP Server, specifically in the mod_proxy_uwsgi module, which is used to connect the server to certain types of applications. The problem happens when the server gets a specially crafted response from one of these applications, using something called Transfer-Encoding². This can trick the server into sending the wrong responses to users, potentially allowing an attacker to do things like steal user sessions or perform phishing attacks. The affected versions are Apache HTTP Server 2.4.30 through 2.4.68.
How it actually works
Here is how it works: when the Apache server uses mod_proxy_uwsgi to talk to an application, it expects the application to send responses in a certain format. But if an attacker can send a response that looks right but actually has extra data hidden in it, using Transfer-Encoding, the server might not notice the extra data and could send it on to users. This is possible because of an inconsistent interpretation of HTTP requests³, which is a fancy way of saying the server and the application do not always agree on what the requests mean.
Proof of concept
There is a public mention of this issue, but it is not clear from the source if there is a fully developed proof-of-concept⁴ that demonstrates the bug. A proof-of-concept would show that the flaw is real and can be exploited, which would make it more urgent to fix. It would prove that an attacker could actually use this bug to sneak past security checks.
Is it real
It is not clear from the source if this bug is being actively exploited in the wild. The severity is listed as low, which suggests it may not be as easy to exploit as other bugs. One limiting factor could be that the mod_proxy_uwsgi module might not be enabled on all servers, which would prevent the bug from being exploited on those servers.
What to do
To fix this bug, users should update their Apache HTTP Server to a version that is not affected, or apply a patch if one is available. This would prevent an attacker from being able to sneak past security checks using this bug.
Terms
- ¹ response smuggling vulnerability
- , a type of security vulnerability that allows an attacker to sneak extra data past security checks
- ² Transfer-Encoding
- , a way of encoding data in HTTP responses so that it can be transferred more efficiently
- ³ HTTP requests
- , a set of rules for how HTTP requests and responses should be formatted and interpreted
- ⁴ proof-of-concept
- , a demonstration of how a security vulnerability can be exploited, used to prove that the flaw is real and can be used by attackers