Varnish Cache Workspace Information Leak Vulnerability

A vulnerability in Varnish Cache versions prior to 6.0.5 LTS, 6.1.x, 6.2.x prior to 6.2.2, and 6.3.x prior to 6.3.1, allows for an information leak from the connection workspace. The issue arises because a pointer is not cleared between handling client requests on the same connection, which can inadvertently disclose data structures and temporary VCL-related headers from previous requests. The vulnerability is triggered when Varnish switches to synthetic response handling due to an internal error, such as reaching the maximum number of allowed VCL restarts or receiving invalid HTTP headers from a backend response.

Impact

Exploitation of this vulnerability leads to an information leak from the connection workspace, potentially disclosing stale header data, data structures from previous requests, or temporary VCL-related headers.

Reproduction

To reproduce this vulnerability, send multiple requests over the same connection to a vulnerable Varnish server that is configured in a way that allows the first request to trigger synthetic response handling. This can be done by exceeding the maximum allowed VCL restarts or by causing a backend response to fail without sending valid HTTP headers. The leaked information can be observed in the HTTP response sent to the client.

Remediation

Users can update to Varnish Cache versions 6.3.1, 6.2.2, or 6.0.5 LTS to address this vulnerability. Alternatively, the issue can be mitigated through VCL by overriding the resp.reason field in the vcl_synth function.