CVE-2019-20445

Q: What is the severity of CVE-2019-20445?

CVE-2019-20445 has a CVSS score of 9.1 (CRITICAL). This vulnerability in Netty's HTTP decoder allows HTTP request smuggling by accepting conflicting Content-Length and Transfer-Encoding headers. Attackers can exploit this to bypass security controls, poison caches, or hijack user sessions. Any application using vulnerable Netty versions for HTTP processing is affected.

9.1 CRITICAL

📋 TL;DR

This vulnerability in Netty's HTTP decoder allows HTTP request smuggling by accepting conflicting Content-Length and Transfer-Encoding headers. Attackers can exploit this to bypass security controls, poison caches, or hijack user sessions. Any application using vulnerable Netty versions for HTTP processing is affected.

💻 Affected Systems

Products:

Netty

Versions: All versions before 4.1.44

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects applications using Netty's HTTP decoder. Applications not processing HTTP requests are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete request smuggling leading to cache poisoning, session hijacking, credential theft, or backend system compromise through crafted requests.

🟠

Likely Case

Request smuggling enabling bypass of security filters, injection of malicious content, or unauthorized access to restricted endpoints.

🟢

If Mitigated

Limited impact with proper input validation and WAF filtering, though underlying vulnerability remains.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

HTTP request smuggling techniques are well-documented and can be automated.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.1.44 and later

Vendor Advisory: https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2

Restart Required: Yes

Instructions:

1. Update Netty dependency to version 4.1.44 or later. 2. Update pom.xml or build.gradle with new version. 3. Rebuild and redeploy application. 4. Restart affected services.

🔧 Temporary Workarounds

WAF Rule for HTTP Header Validation

all

Configure web application firewall to reject requests with multiple Content-Length headers or conflicting Content-Length and Transfer-Encoding headers.

Reverse Proxy Validation

all

Configure reverse proxies (nginx, Apache) to normalize and validate HTTP headers before passing to backend.

🧯 If You Can't Patch

Implement strict HTTP header validation at application layer
Deploy WAF with specific rules for HTTP request smuggling detection

🔍 How to Verify

Check if Vulnerable:

Check Netty version in dependencies: grep -r 'netty' pom.xml build.gradle gradle.properties

Check Version:

java -cp "*" io.netty.util.Version

Verify Fix Applied:

Verify Netty version is 4.1.44 or higher: mvn dependency:tree | grep netty OR gradle dependencies | grep netty

📡 Detection & Monitoring

Log Indicators:

Multiple Content-Length headers in single request
Conflicting Content-Length and Transfer-Encoding headers
Unusual request parsing errors

Network Indicators:

HTTP requests with duplicate headers
Abnormal request/response timing patterns
Unexpected backend responses

SIEM Query:

http.headers:"Content-Length" AND count>1 OR (http.headers:"Content-Length" AND http.headers:"Transfer-Encoding")

📊 Metadata

CVE ID: CVE-2019-20445

CVSS v3 Score: 9.1 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE: CWE-444

Published: January 29, 2020

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Debian Linux by Debian

Debian Linux by Debian

Fedora by Fedoraproject

Jboss Amq Clients by Redhat

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Netty by Netty

Spark by Apache

Spark by Apache

Ubuntu Linux by Canonical

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

WAF Rule for HTTP Header Validation

Reverse Proxy Validation

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities