Summary<\/p>\n
Before version 0.9.0, the HTTP\/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client’s Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP\/2 upstream path already removed Connection and related HTTP\/1-specific headers. A client could therefore nominate a header that the application adds in upstream_request_filter (for example, Connection: keep-alive, X-Forwarded-For). A downstream HTTP\/1 intermediary that honors Connection would then strip the Pingora-added header before it reached the origin.<\/p>\n
Impact<\/p>\n
Specifically affects chained deployments where an HTTP\/1 intermediary between Pingora and the origin processes Connection nominations (for example, Go’s net\/http\/httputil.ReverseProxy) and the origin trusts headers added by that intermediary (for example, X-Forwarded-For for IP-based authorization). A remote, unauthenticated attacker can have those headers removed, potentially bypassing authorization. The reporter demonstrated access to an IP-restricted endpoint using X-Forwarded-For for IP validation on the origin. This is the same class of issue as CVE-2022-31813 in Apache HTTP Server.<\/p>\n
Note that Cloudflare CDN customers were unaffected, as no such chained deployment as described above exists with internal Pingora services, and Connection headers are sanitized before arriving at Pingora gateways.<\/p>\n
Mitigation:<\/p>\n
* <\/p>\n
Upgrade to pingora 0.9.0 or later. By default, Pingora now removes hop-by-hop and Connection-nominated headers from upstream requests, and rejects requests whose Connection header nominates Host, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, or a pseudo-header. This is controlled by PeerOptions::http_upstream_request_policy (HttpUpstreamRequestPolicy). Fix commits: https:\/\/github.com\/cloudflare\/pingora\/commit\/28c18e6b6b04dd0bd937234e5950049e6d74cded , https:\/\/github.com\/cloudflare\/pingora\/commit\/ca23f1668eca8e78be7ba62ef0edbd458b40eeee <\/p>\n
* <\/p>\n
Do not use HttpUpstreamRequestPolicy::preserve() if the origin relies on headers added by Pingora; it restores the old passthrough behavior.<\/p>\n
* <\/p>\n
If you cannot upgrade: in upstream_request_filter, remove the Connection header and every header it nominates before adding trusted headers.<\/p>\n","protected":false},"excerpt":{"rendered":"
Summary<\/p>\n
Before version 0.9.0, the HTTP\/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client’s Conn<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41973","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}