CVE-2024-32638
📋 TL;DR
This CVE describes an HTTP request smuggling vulnerability in Apache APISIX when using the forward-auth plugin. Attackers can exploit inconsistent HTTP request parsing to bypass security controls, poison caches, or hijack user sessions. Affected users are those running Apache APISIX versions 3.8.0, 3.9.0 with the forward-auth plugin enabled.
💻 Affected Systems
- Apache APISIX
📦 What is this software?
Apisix by Apache
Apisix by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass authentication entirely, poison proxy caches with malicious content, hijack user sessions, or perform cache poisoning attacks against downstream systems.
Likely Case
Attackers bypass security controls implemented via forward-auth, potentially gaining unauthorized access to protected resources or services.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential cache poisoning or minor security control bypass.
🎯 Exploit Status
HTTP request smuggling requires understanding of HTTP protocol inconsistencies and specific plugin behavior.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.8.1, 3.9.1 or higher
Vendor Advisory: https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop APISIX service. 3. Upgrade to version 3.8.1, 3.9.1 or higher. 4. Restart APISIX service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable forward-auth plugin
allTemporarily disable the vulnerable forward-auth plugin until patching is possible.
apisix stop
Edit APISIX configuration to remove or disable forward-auth plugin
apisix start
🧯 If You Can't Patch
- Implement WAF with HTTP request smuggling protection
- Monitor for unusual HTTP traffic patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check APISIX version and verify forward-auth plugin is enabled: apisix version && check configuration files for forward-auth plugin.Check Version:
apisix versionVerify Fix Applied:
Verify APISIX version is 3.8.1, 3.9.1 or higher: apisix version📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP request patterns
- Multiple requests with same connection
- Requests with conflicting Content-Length and Transfer-Encoding headers
Network Indicators:
- HTTP requests with malformed headers
- Unexpected request smuggling patterns
SIEM Query:
source="apisix" AND (http_request_smuggling OR transfer_encoding OR content_length)