^{CVE-2020-1935:}HTTP Request Smuggling vulnerability in Apache Tomcat due to improper header parsing

Overview

CVE-2020-1935 is a vulnerability in Apache Tomcat's HTTP header parsing mechanism that could lead to HTTP Request Smuggling attacks. The issue occurs because Tomcat incorrectly validates end-of-line sequences in HTTP headers, allowing some malformed headers to be accepted as legitimate. When Tomcat operates behind a reverse proxy that handles these invalid headers differently than Tomcat does, an attacker could potentially craft specially formed requests that are interpreted differently by the proxy and Tomcat, leading to request smuggling.

HTTP Request Smuggling (CWE-444) is a technique where an attacker exploits discrepancies in parsing HTTP requests between two HTTP devices (typically a proxy/load balancer and a web server) to "smuggle" unauthorized HTTP requests to the backend server. This can potentially lead to cache poisoning, request hijacking, or bypassing of security controls.

The vulnerability affects multiple versions of Apache Tomcat across three major release branches: 7.x, 8.5.x, and 9.0.x.

Remediation

To address this vulnerability, users should upgrade to the following patched versions of Apache Tomcat:

• For Tomcat 9.x: Upgrade to version 9.0.31 or later
• For Tomcat 8.5.x: Upgrade to version 8.5.51 or later
• For Tomcat 7.x: Upgrade to version 7.0.100 or later

If immediate upgrading is not possible, the following mitigations can reduce risk:

1. Ensure that any reverse proxy in front of Tomcat is configured to strictly validate HTTP headers
2. Configure firewalls to block malformed HTTP requests
3. Monitor for suspicious HTTP traffic patterns that might indicate request smuggling attempts

Organizations using vendor-specific distributions of Tomcat (such as those included in Oracle products or Linux distributions) should apply vendor-provided patches as they become available.

References

1. Apache Tomcat Security Announcement: https://lists.apache.org/thread.html/r127f76181aceffea2bd4711b03c595d0f115f63e020348fe925a916c%40%3Cannounce.tomcat.apache.org%3E
2. Oracle Security Advisory: https://www.oracle.com/security-alerts/cpujul2020.html
3. NetApp Security Advisory: https://security.netapp.com/advisory/ntap-20200327-0005/
4. Ubuntu Security Notice: https://usn.ubuntu.com/4448-1/
5. Debian Security Advisory: https://www.debian.org/security/2020/dsa-4673
6. MITRE CWE-444 (HTTP Request Smuggling): https://cwe.mitre.org/data/definitions/444.html