Elixir Mint HTTP Response Smuggling Vulnerability

A vulnerability allowing HTTP response smuggling has been identified in the Elixir Mint library, specifically in versions 0.1.0 prior to 1.9.3. This issue arises from an inconsistent interpretation of HTTP chunked transfer encoding, where the Mint HTTP/1 client accepts sign-prefixed chunk sizes that are rejected by strict intermediaries. Exploitation of this vulnerability can lead to desynchronization between the client and intermediary, allowing for response-queue poisoning on pooled connections.

Impact

Exploitation of this vulnerability allows a malicious HTTP/1 server to inject responses into the Mint client's response queue, corrupting the data received by unrelated in-flight requests on the same connection.

Reproduction

To reproduce this vulnerability, deploy an Elixir Mint HTTP/1 client that uses connection pooling and keep-alive. Introduce an RFC-strict HTTP/1 intermediary between the Mint client and an attacker-controlled origin. When the origin sends a response with sign-prefixed chunk sizes, the Mint client will accept these while the intermediary rejects them, creating a desynchronization that can be exploited to poison the response queue.

Remediation

Users can upgrade to Elixir Mint version 1.9.3 or later, where this vulnerability has been fixed.