Http4s Trailer Header Handling Vulnerability Leading to HTTP Request Smuggling

A vulnerability allowing HTTP request smuggling has been identified in Http4s, a Scala library for HTTP services. This issue affects versions 1.0.0-M1 prior to 1.0.0-M45, as well as versions prior to 0.23.31. The vulnerability arises from improper management of HTTP trailer headers, which can enable attackers to bypass security controls of front-end servers, conduct targeted attacks on active users, and disrupt web caching. Exploitation requires the web application to be behind a reverse proxy that forwards trailer headers.

Impact

Exploitation of this vulnerability allows for HTTP request smuggling, where one request is misinterpreted as two. This can lead to bypassing security controls, attacking users, and web cache poisoning.

Reproduction

The vulnerability can be reproduced by sending a chunked HTTP request that includes trailer headers. The server will parse the request incorrectly, leading to the smuggling of another request, which can be verified by observing the server's response.

Remediation

Users can update to Http4s versions 1.0.0-M45 or 0.23.31, where this vulnerability has been patched.