GHSA-v8h7-rr48-vmmv: Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection
SummaryNetty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`.The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests.In practice, this leads to HTTP request smuggling / desynchronization on the HTTP side and request injection on the RTSP side.DetailsThe root issue is that URI validation exists only on the constructor path, but not on the public setter path.`io.netty.handler.codec.http.DefaultHttpRequest`The constructor calls `HttpUtil.validateRequestLineTokens(method, uri)``setUri(String uri)` only performs `checkNotNull` and does not validate`io.netty.handler.codec.http.DefaultFullHttpRequest``setUri(String uri)` delegates to the parent implementation`io.netty.handler.codec.http.HttpRequestEncoder`Writes `request.uri()` directly into the request line`io.netty.handler.codec.rtsp.RtspEncoder`Writes `request.uri()` directly into the request lineThis creates the following bypass:An application creates a `DefaultHttpRequest` or `DefaultFullHttpRequest` with a safe URILater, attacker-influenced input is passed into `setUri()``HttpRequestEncoder` or `RtspEncoder` encodes that value verbatimThe downstream server, proxy, or RTSP peer interprets the injected bytes after CRLF as separate requestsThis appears to be an incomplete fix pattern where start-line validation exists, but can still be bypassed through a mutable public API.PoC (HTTP)The following code first creates a normal request object and then injects a malicious request line using `setUri()`.When reproduced, the raw encoded request looks like this:`HttpServerCodec` then parses this as multiple HTTP messages rather than a single request:`GET /s1``POST /s2` with body `Hello World`trailing `GET /s1`This confirms that the value supplied through `setUri()` is interpreted on the wire as additional requests.PoC (RTSP)The same root cause also affects `RtspEncoder`. A minimal reproduction is shown below.When reproduced, `RtspEncoder` generates consecutive RTSP requests in a single encoded payload:`RtspDecoder` then parses this as three separate RTSP requests:`OPTIONS rtsp://cam/stream``DESCRIBE rtsp://cam/secret``OPTIONS rtsp://cam/final`This confirms that the same setter bypass is exploitable for RTSP request injection as well.ImpactThe vulnerable conditions are:The application uses `DefaultHttpRequest` or `DefaultFullHttpRequest`The request object is created first and later modified through `setUri()`The value passed into `setUri()` is attacker-controlled or attacker-influencedThe object is eventually serialized by `HttpRequestEncoder` or `RtspEncoder`Under those conditions, an attacker may be able to:perform HTTP request smugglingtrigger proxy/backend desynchronizationinject additional requests toward internal APIsconfuse request boundaries and bypass assumptions around authentication or routinginject RTSP requestsThe exact impact depends on how the application constructs URIs and how the upstream/downstream HTTP or RTSP components parse request boundaries, but the security impact is real and reproducible.Root CauseValidation is enforced only at object construction time, but not on the public mutation API that can break the same security invariant.As a result, the constructors are safe while the public `setUri()` path is not, and the encoders trust and serialize the mutated value without revalidation.Suggested Fix Direction`DefaultHttpRequest.setUri()` and all delegating/inheriting paths should apply the same request-line token validation as the constructors.Recommended regression coverage:verify that `setUri()` rejects CRLF-containing input after object constructionverify that `DefaultFullHttpRequest.setUri()` is blocked as wellverify that spaces, `\r`, `\n`, and request-smuggling payloads are rejectedverify that both `HttpRequestEncoder` and `RtspEncoder` are protected from setter-based bypassesAffected Area`netty-codec-http``io.netty.handler.codec.http.DefaultHttpRequest``io.netty.handler.codec.http.DefaultFullHttpRequest``io.netty.handler.codec.http.HttpRequestEncoder``io.netty.handler.codec.rtsp.RtspEncoder`
CVSS v3.1: 5.3