CVE-2022-29361
📋 TL;DR
CVE-2022-29361 is an HTTP request smuggling vulnerability in Pallets Werkzeug v2.1.0 and below that allows attackers to bypass security controls by sending crafted HTTP requests containing multiple requests in the body. This affects applications using Werkzeug's development server in unsupported configurations. The vendor notes this only occurs in development mode with external HTTP servers.
💻 Affected Systems
- Pallets Werkzeug
📦 What is this software?
Werkzeug by Palletsprojects
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass authentication, access control, or perform cache poisoning attacks leading to data theft or system compromise.
Likely Case
HTTP request smuggling allowing attackers to manipulate request processing and potentially bypass security filters.
If Mitigated
Limited impact if proper production configurations are used with supported HTTP servers.
🎯 Exploit Status
Exploitation requires specific unsupported configurations but is straightforward when conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.1.1 and above
Vendor Advisory: https://github.com/pallets/werkzeug/security/advisories/GHSA-2p5j-mcrf-ffh8
Restart Required: Yes
Instructions:
1. Update Werkzeug to v2.1.1 or later using pip: pip install --upgrade werkzeug 2. Restart the application server 3. Verify the update with: python -c "import werkzeug; print(werkzeug.__version__)"
🔧 Temporary Workarounds
Disable development mode
allEnsure Werkzeug is running in production mode with supported HTTP servers only.
export FLASK_ENV=production
export FLASK_DEBUG=0
Use Werkzeug's built-in development server
allAvoid using external HTTP servers with Werkzeug in development mode.
🧯 If You Can't Patch
- Ensure Werkzeug is only used in production configurations with supported HTTP servers (not development mode with external servers).
- Implement network-level controls like WAFs to detect and block HTTP request smuggling attempts.
🔍 How to Verify
Check if Vulnerable:
Check if Werkzeug version is 2.1.0 or below and running in development mode with external HTTP server.Check Version:
python -c "import werkzeug; print(werkzeug.__version__)"Verify Fix Applied:
Verify Werkzeug version is 2.1.1 or above and development mode is disabled or using built-in server.📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP requests in single log entries
- Unusual request parsing errors
- Malformed HTTP headers in logs
Network Indicators:
- HTTP requests with unusual body structures
- Requests containing multiple HTTP methods in body
SIEM Query:
source="*werkzeug*" AND ("malformed request" OR "request smuggling" OR "invalid http")