CVE-2024-52530
📋 TL;DR
This vulnerability in GNOME libsoup allows HTTP request smuggling by ignoring null characters at the end of HTTP header names. Attackers can craft malicious requests that bypass security controls, potentially leading to cache poisoning, session hijacking, or credential theft. It affects applications using vulnerable versions of libsoup for HTTP communication.
💻 Affected Systems
- GNOME libsoup
📦 What is this software?
Libsoup by Gnome
⚠️ Risk & Real-World Impact
Worst Case
Attackers could poison caches, hijack user sessions, steal credentials, or bypass authentication/authorization controls by smuggling malicious requests through proxies.
Likely Case
Cache poisoning leading to credential theft or session hijacking, particularly in environments with reverse proxies or load balancers.
If Mitigated
Limited impact with proper input validation and request sanitization at proxy layers.
🎯 Exploit Status
Exploitation requires crafting specific HTTP requests with null characters in header names. No public exploit code identified yet.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.0 and later
Vendor Advisory: https://gitlab.gnome.org/GNOME/libsoup/-/issues/377
Restart Required: Yes
Instructions:
1. Update libsoup to version 3.6.0 or later. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade libsoup-3.0-0. 3. Restart affected applications/services.
🔧 Temporary Workarounds
Input validation at proxy layer
allConfigure reverse proxies or load balancers to reject HTTP requests containing null characters in headers.
🧯 If You Can't Patch
- Implement strict HTTP header validation at application or proxy layer to reject requests with null characters.
- Monitor for unusual HTTP request patterns and implement rate limiting on suspicious endpoints.
🔍 How to Verify
Check if Vulnerable:
Check libsoup version: dpkg -l | grep libsoup-3.0-0 or rpm -qa | grep libsoup. Versions below 3.6.0 are vulnerable.Check Version:
pkg-config --modversion libsoup-3.0Verify Fix Applied:
Confirm libsoup version is 3.6.0 or higher using version check command.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with headers containing null characters or unusual Transfer-Encoding values
- Multiple requests from same source with varying header formats
Network Indicators:
- HTTP traffic with malformed headers containing null bytes
- Unusual request smuggling patterns
SIEM Query:
http.headers:*\0* OR http.headers:*Transfer-Encoding* AND NOT http.headers:*Transfer-Encoding: chunked*