CVE-2022-24766
📋 TL;DR
CVE-2022-24766 is an HTTP request smuggling vulnerability in mitmproxy that allows malicious clients or servers to bypass security controls. Attackers can smuggle hidden HTTP requests through mitmproxy that evade detection and custom security hooks. This affects mitmproxy versions 7.0.4 and below when used with HTTP/1 services.
💻 Affected Systems
- mitmproxy
📦 What is this software?
Mitmproxy by Mitmproxy
⚠️ Risk & Real-World Impact
Worst Case
Attackers bypass all mitmproxy security controls including authentication, authorization, and input validation, potentially leading to unauthorized access, data exfiltration, or command injection on backend systems.
Likely Case
Bypass of custom security checks implemented in mitmproxy event hooks, allowing unauthorized requests to reach protected backend services.
If Mitigated
Limited impact if mitmproxy is only used with HTTP/2 or HTTPS services, or if backend services have their own robust security controls.
🎯 Exploit Status
Exploitation requires understanding of HTTP request smuggling techniques but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.0 and above
Vendor Advisory: https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-gcx2-gvj7-pxv3
Restart Required: Yes
Instructions:
1. Stop mitmproxy service. 2. Upgrade to mitmproxy 8.0.0 or later using pip: 'pip install --upgrade mitmproxy'. 3. Restart mitmproxy service.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Discontinue use of mitmproxy with HTTP/1 services and migrate to HTTP/2 or HTTPS.
- Implement additional security controls at the backend service level to validate all incoming requests.
🔍 How to Verify
Check if Vulnerable:
Check mitmproxy version with 'mitmproxy --version'. If version is 7.0.4 or below, system is vulnerable.Check Version:
mitmproxy --versionVerify Fix Applied:
After upgrade, verify version is 8.0.0 or above with 'mitmproxy --version'.📡 Detection & Monitoring
Log Indicators:
- Unexpected HTTP requests appearing in backend server logs that don't appear in mitmproxy logs
- Requests with unusual Content-Length or Transfer-Encoding headers
Network Indicators:
- HTTP traffic with inconsistent request/response parsing between mitmproxy and backend servers
SIEM Query:
source="backend_server" http.method=* NOT source="mitmproxy" http.method=* | stats count by http.method, src_ip🔗 References
- https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b
- https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-gcx2-gvj7-pxv3
- https://mitmproxy.org/posts/releases/mitmproxy8/
- https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b
- https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-gcx2-gvj7-pxv3
- https://mitmproxy.org/posts/releases/mitmproxy8/
