RUSTSEC-2020-0008

    Dashboard / Vulnerabilities / RUSTSEC-2020-0008

    RUSTSEC-2020-0008

    Published: 19 Mar 2020Last Modified: 8 Nov 2023

    Summary: Flaw in hyper allows request smuggling by sending a body in GET requests

    Details: Vulnerable versions of hyper allow GET requests to have bodies, even if there is no Transfer-Encoding or Content-Length header. As per the HTTP 1.1 specification, such requests do not have bodies, so the body will be interpreted as a separate HTTP request. This allows an attacker who can control the body and method of an HTTP request made by hyper to inject a request with headers that would not otherwise be allowed, as demonstrated by sending a malformed HTTP request from a Substrate runtime. This allows bypassing CORS restrictions. In combination with other vulnerabilities, such as an exploitable web server listening on loopback, it may allow remote code execution. The flaw was corrected in hyper version 0.12.34.

    References: https://crates.io/crates/hyper, https://rustsec.org/advisories/RUSTSEC-2020-0008.html, https://github.com/hyperium/hyper/issues/1925

    Affected packages

    Package

    Name: hyper

    Purl: pkg:cargo/hyper

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.11.0
    Fixed -0.12.34

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2020-0008 | CVE-DB