Withdrawn: HTTP Request Smuggling in Agoo
Moderate severity
GitHub Reviewed
Published
Oct 20, 2020
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Withdrawn
This advisory was withdrawn on Jan 13, 2021
Description
Reviewed
Oct 20, 2020
Published to the GitHub Advisory Database
Oct 20, 2020
Withdrawn
Jan 13, 2021
Last updated
Jan 9, 2023
Withdrawn reason
Withdrawn on 1/13/2021 due to this comment from the maintainer. This is no longer considered a vulnerability.
Original description
agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.
References