CVE-2018-21245
📋 TL;DR
CVE-2018-21245 is an HTTP request smuggling vulnerability in Pound reverse proxy/load balancer versions before 2.8. This allows attackers to bypass security controls, poison caches, and potentially hijack user sessions. Organizations using Pound as a front-end proxy are affected.
💻 Affected Systems
- Pound
📦 What is this software?
Pound by Apsis
⚠️ Risk & Real-World Impact
Worst Case
Attackers could poison proxy caches, bypass authentication, hijack user sessions, and perform cross-site scripting attacks against users behind the proxy.
Likely Case
Cache poisoning leading to users receiving malicious content, authentication bypass for protected resources, and session hijacking.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and monitoring are in place to detect anomalous HTTP traffic patterns.
🎯 Exploit Status
HTTP request smuggling techniques are well-documented and can be adapted for this vulnerability. Exploitation requires sending specially crafted HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8 and later
Vendor Advisory: https://admin.hostpoint.ch/pipermail/pound_apsis.ch/2018-May/000054.html
Restart Required: Yes
Instructions:
1. Download Pound 2.8 or later from the official website. 2. Stop the Pound service. 3. Install the new version. 4. Restart the Pound service. 5. Verify the version is 2.8 or higher.
🔧 Temporary Workarounds
Use alternative reverse proxy
allReplace Pound with a different reverse proxy/load balancer that is not vulnerable to HTTP request smuggling.
Implement WAF rules
allConfigure Web Application Firewall rules to detect and block HTTP request smuggling attempts.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Pound instances from untrusted networks
- Deploy intrusion detection systems to monitor for HTTP request smuggling patterns
🔍 How to Verify
Check if Vulnerable:
Check Pound version using 'pound -V' or 'pound -v'. If version is below 2.8, the system is vulnerable.Check Version:
pound -VVerify Fix Applied:
After patching, run 'pound -V' or 'pound -v' and confirm version is 2.8 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP request patterns
- Multiple requests with same connection
- Malformed HTTP headers in logs
Network Indicators:
- HTTP requests with conflicting Content-Length and Transfer-Encoding headers
- Requests that appear to contain multiple HTTP messages
SIEM Query:
source="pound.log" AND ("Transfer-Encoding" AND "Content-Length") OR "malformed request"