CVE-2024-32638 - Vulnerability Details - OpenCVE

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apache Software Foundation	Apache Apisix

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/05/02/2
https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov

History

Thu, 13 Feb 2025 18:00:00 +0000

Type	Values Removed	Values Added
Description	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-05-02T09:20:29.127Z

Updated: 2025-02-13T17:52:13.382Z

Reserved: 2024-04-16T11:56:04.600Z

Link: CVE-2024-32638

Vulnrichment

Updated: 2024-08-02T02:13:40.364Z

NVD

Status : Awaiting Analysis

Published: 2024-05-02T10:15:08.443

Modified: 2025-02-13T18:18:02.733

Link: CVE-2024-32638

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32638", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-04-16T11:56:04.600Z", "datePublished": "2024-05-02T09:20:29.127Z", "dateUpdated": "2025-02-13T17:52:13.382Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache APISIX", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.9.0", "status": "affected", "version": "3.8.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Discovered and reported by Brandon Arp and Bruno Green of Topsort."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')</span> vulnerability in Apache APISIX when using `forward-auth` plugin.<p>This issue affects Apache APISIX: from 3.8.0, 3.9.0.</p><p>Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.</p>"}], "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')\u00a0vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.\n\nUsers are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-05-02T09:25:07.477Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov"}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/2"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache APISIX: Forward-Auth Request Smuggling", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-32638", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-02T13:37:37.631816Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache_software_foundation:Apache_APISIX:3.8.0:*:*:*:*:*:*:*"], "vendor": "apache_software_foundation", "product": "Apache_APISIX", "versions": [{"status": "affected", "version": "3.8.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:51:36.154Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:13:40.364Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov"}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/2", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:13:40.364Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-32638", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-02T13:37:37.631816Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache_software_foundation:Apache_APISIX:3.8.0:*:*:*:*:*:*:*"], "vendor": "apache_software_foundation", "product": "Apache_APISIX", "versions": [{"status": "affected", "version": "3.8.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-02T13:39:29.693Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Apache APISIX: Forward-Auth Request Smuggling", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Discovered and reported by Brandon Arp and Bruno Green of Topsort."}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache APISIX", "versions": [{"status": "affected", "version": "3.8.0", "versionType": "custom", "lessThanOrEqual": "3.9.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/2"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')\u00a0vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.\n\nUsers are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')</span> vulnerability in Apache APISIX when using `forward-auth` plugin.<p>This issue affects Apache APISIX: from 3.8.0, 3.9.0.</p><p>Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-05-02T09:25:07.477Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32638", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:52:13.382Z", "dateReserved": "2024-04-16T11:56:04.600Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-05-02T09:20:29.127Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}