Microsoft: ASP.NET Core Kestrel HTTP Request Smuggling via Chunk Extension Parsing

Per Praetorian’s blog: “While testing different implementations, I found that ASP.NET Core‘s Kestrel server was vulnerable to request smuggling through malformed chunked transfer encoding extensions. … I then sent the following malformed HTTP request with a newline character (n) embedded in the chunk extension … The server only echoed back xy, indicating that nxx was being treated as part of the chunk extension. This parsing leniency creates a TERM.EXT vulnerability: When deployed behind front-end proxies that interpret the lone n as a line terminator, this enables request smuggling.” NVD describes the issue as “Inconsistent interpretation of HTTP requests (‘http request/response smuggling’) in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.”