public security bugs

[pajod]

This contains only publicly documented security-sensitive parser issues in Gunicorn 23.0.0

This PR is meant to simplify testing patches and gather feedback on edge cases until decisions are made upstream.

• missing URL validation for CONNECT method

  • likelihood: only crafted requests
  • exploitable if: behind proxy and application accepts CONNECT method
  • impact: confused proxy (request smuggling)
  • public issue: Parsing issue of the CONNECT method benoitc/gunicorn#3363
  • public PR: refuse HTTP method CONNECT benoitc/gunicorn#3367
  • UNFINISHED: should not use 405, see https://datatracker.ietf.org/doc/html/rfc9110#name-405-method-not-allowed

• ignoring invalid whitespace in transfer-coding

  • likelihood: only crafted requests
  • exploitable if: incorrect proxy behavior
  • impact: confused proxy (request smuggling)
  • public issue: Gunicorn incorrectly strips certain characters from transfer-codings benoitc/gunicorn#3364
  • public PR: remove whitespace in transfer-encoding benoitc/gunicorn#3369

• NUL in URLs

  • likelihood: only crafted requests
  • exploitable if: incorrect proxy behavior
  • impact: confused proxy (request smuggling)
  • public issue: Gunicorn incorrectly accepts NUL within URIs benoitc/gunicorn#3371
  • public PR: (permissive) request target validation benoitc/gunicorn#3373

• pretending to support additional T-E

  • likelihood: only crafted requests
  • exploitable if: always (unless blocked by proxy)
  • impact: confused application (wrong body), WAF bypass (checked body != used body)
  • public PR: stop pretending to support gzip *request* transfer-encoding benoitc/gunicorn#3368

• wrong host when using absolute-form or multiple host headers

  • likelihood: rare (only unusual clients)
  • exploitable if: incorrect proxy behavior
  • impact: WAF bypass (checked URL != used URL)
  • public issue: Issues in Parsing HTTP Request "Host" Header benoitc/gunicorn#3361
  • public issue: Incorrect Handling of Absolute-Form Request-Target Authority benoitc/gunicorn#3370
  • UNFINISHED: conflicting Host header is must be ignored, not refused

• accepting requests lacking a host header

  • likelihood: rare (only unusual clients and/or connections via unix sockets)
  • exploitable if: application parses env
  • impact: application crash upon receipt of unusual SERVER_NAME / SERVER_PORT
  • public issue: Issues in Parsing HTTP Request "Host" Header benoitc/gunicorn#3361

• invalid controls in chunk extensions

  • likelihood: only crafted requests
  • exploitable if: incorrect proxy behavior
  • impact: confused proxy (request smuggling)
  • public PR: fix: problematic parsing leniency in parsing chunk extensions benoitc/gunicorn#3327

• informational responses to HTTP/1.0 requests

  • likelihood: common
  • exploitable if: incorrect or ancient proxy
  • impact: confused proxy (response smuggling), confused client (partial response)
  • public issue: unexpected informational 1xx responses benoitc/gunicorn#3374