PT-2021-22466 · Mitmproxy+1 · Mitmproxy+1

Chinchila + 1 · Published 2021-09-16 · Updated 2023-08-20 · CVE-2021-39214

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mitmproxy versions 7.0.2 and below

Description A malicious client or server can perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

Recommendations For mitmproxy versions 7.0.2 and below, update to mitmproxy 7.0.3 or above to fix the vulnerability. Unless mitmproxy is used to protect an HTTP/1 service, no action is required. As a temporary workaround, consider restricting access to the HTTP message body to minimize the risk of exploitation.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-39214

GHSA-22GH-3R9Q-XF38

OPENSUSE-SU-2023:0232-1

OPENSUSE-SU-2023:0233-1

PYSEC-2021-328

Affected Products

Debian

Mitmproxy

References · 19

• https://osv.dev/vulnerability/CVE-2021-39214 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39214 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39214 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0232-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39214 · Security Note
• https://ubuntu.com/security/CVE-2021-39214 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-328 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-39214 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0233-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39214 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-22gh-3r9q-xf38 · Vendor Advisory
• https://github.com/mitmproxy/mitmproxy · Note
• https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-22gh-3r9q-xf38 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mitmproxy/PYSEC-2021-328.yaml · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/ZWVU67ZHXKSRHY3G2VWT27RUWDQHMIG6 · Note