● CVE-2024-27983 / High Severity

CVE-2024-27983: Node.js llhttp HTTP Request Smuggling Teardown

How incomplete Transfer-Encoding chunk extension parsing in deps/llhttp caused HTTP request desynchronization, enabling cache poisoning and credential theft.

💡 비유를 통한 쉬운 설명 (ELI5)

Imagine a two-window ticket booth. Window 1 reads: 'One ticket for Alice'. Window 2 reads: 'Wait, there's another ticket for Bob glued to the back'. Because Window 1 ignored the extra ticket, Bob's ticket sits in the window until Charlie walks up. Charlie gets handed Bob's ticket and private receipt, allowing an attacker to steal user sessions.

핵심 개념 및 서브시스템 용어 해설

llhttp: The high-performance C HTTP parser library embedded inside Node.js to parse incoming HTTP/1.1 requests.
HTTP Request Smuggling: Desynchronization between frontend reverse proxies (e.g. NGINX, Cloudflare) and backend Node.js servers regarding request boundaries.
Chunked Transfer-Encoding: An HTTP streaming mechanism where payloads are sent in numbered chunks, terminated by a `0\r\n\r\n` chunk.
Chunk Extensions: Optional semicolon-delimited parameters appended to the chunk length (`0;extension=value\r\n`).

단계별 공격 실행 메커니즘

Step 1

1. Send Ambiguous Request

The attacker sends an HTTP request with chunk extensions containing unescaped control characters.

Step 2

2. Frontend Interpretation

The frontend proxy treats the entire payload as a single continuous request body.

Step 3

3. Node.js Parser Desync

Node.js's llhttp stops parsing prematurely, leaving the smuggled second request in the TCP buffer.

Step 4

4. Victim Session Hijacking

The next innocent user's request is prepended to the smuggled request, exfiltrating their session tokens.

소스 코드 비교: 치명적 취약점 vs 보안 강화 패치

일반 개발자가 쉽게 이해할 수 있는 고수준 소스 코드로 제공 (어셈블리/바이너리 제외).

패치되지 않은 취약점

// VULNERABLE: deps/llhttp/src/llhttp.c before patch
int llhttp__on_chunk_extension(llhttp_t *parser, const char *p, const char *end) {
    // ROOT CAUSE:
    // Does not enforce strict ASCII validation on chunk extension tokens!
    // Tolerates invalid whitespace and carriage return sequences, desyncing from proxies!
    while (p < end && *p != '\r' && *p != '\n') {
        p++; // Skips unvetted extension bytes
    }
    return 0;
}

보안 강화 패치

// SECURE: deps/llhttp/src/llhttp.c patch
int llhttp__on_chunk_extension(llhttp_t *parser, const char *p, const char *end) {
    // 1. Strictly validate characters inside chunk extensions according to RFC 9112
    while (p < end && *p != '\r' && *p != '\n') {
        uint8_t ch = (uint8_t)*p;
        // Disallow spaces, control codes, and invalid token bytes
        if (ch <= 0x20 || ch >= 0x7F || ch == ';') {
            return HPE_INVALID_CHUNK_SIZE; // Reject immediately!
        }
        p++;
    }
    return 0;
}

엔지니어링 보안 강화 체크리스트

Strictly enforce RFC 9112 compliance regarding chunk extensions and header delimitations.
Configure frontend reverse proxies to normalize or disallow ambiguous Transfer-Encoding chunk extensions.
Use HTTP/2 or HTTP/3 end-to-end between reverse proxies and backend Node.js services to eliminate framing ambiguities.
Update Node.js across all production containers to versions containing the patched llhttp parser.

← 전체 보안 디렉터리 보기 모든 플랫폼 보안 업데이트 →