TinyWeb HTTP Request Smuggling via Unsupported Transfer-Encoding

Technical Details

Root Cause

TinyWeb does not implement any HTTP transfer coding. It determines the length of a request body from the Content-Length header only. When a request also carried a Transfer-Encoding header (for example Transfer-Encoding: chunked), TinyWeb ignored the transfer coding rather than rejecting the request. It therefore parsed the body octets according to its own rules, which do not match how a compliant proxy or cache that honors Transfer-Encoding would frame the same bytes.

Mechanism

When two HTTP components on the same connection disagree about where one request ends and the next begins, the request stream desynchronizes. An upstream proxy that honors Transfer-Encoding: chunked frames the body one way, while TinyWeb, ignoring the header, frames it another way. The trailing octets that TinyWeb does not consume as part of the first request body are then interpreted as the start of a second, pipelined request that the attacker fully controls.

Attack Scenarios

• Cache poisoning: The smuggled inner request causes a cache in front of TinyWeb to store an attacker-influenced response for a resource requested by other users.
• Access control bypass: A front-end that enforces access controls inspects only the outer request and forwards it, while TinyWeb acts on the smuggled inner request against a resource the front-end intended to protect.
• Request stream desynchronization: Body octets are reinterpreted as a pipelined request, corrupting responses served to subsequent clients sharing the connection.

RFC Compliance

Per RFC 9112 Section 3.3.1, a server that does not implement the transfer coding named in a request must respond with 501 Not Implemented. Silently ignoring the header and processing the body by other means is the exact condition that permits request smuggling.

Fix Applied in Version 2.05

The problem has been patched in version 2.05. Any request with a non-empty Transfer-Encoding header now receives 501 Not Implemented, per RFC 9112 Section 3.3.1, so the ambiguous body can no longer be reinterpreted.

• Fix commit: 06efa04
• Fix pull request: PR #5

Workarounds

If upgrading to v2.05 is not immediately possible, consider the following mitigations:

• Deploy TinyWeb only behind a proxy that normalizes or rejects Transfer-Encoding on requests it forwards.
• Restrict access so that no untrusted intermediary shares a connection to the server.

Timeline

Other TinyWeb CVEs