Summary
Rouille versions 0.3.3 through 3.6.2 contain an HTTP request smuggling flaw where certain client headers are forwarded upstream without sufficient validation.
By injecting bare line feed characters into header values, an attacker can splice in an extra HTTP request that is only seen by the backend, potentially bypassing Rouille's access control logic.
Rouille versions 0.3.3 through 3.6.2 contain an HTTP request smuggling flaw where certain client headers are forwarded upstream without sufficient validation.
By injecting bare line feed characters into header values, an attacker can splice in an extra HTTP request that is only seen by the backend, potentially bypassing Rouille's access control logic.
Affected context
This vulnerability appears in Rouille-based services that act as HTTP frontends, reverse proxies, or gateways to upstream servers such as Go's net/http or Python's http.server.
It is relevant when:
- Rouille copies client-supplied header values verbatim into upstream requests
- The backend HTTP implementation interprets bare LF characters in headers as request delimiters
- Access control, routing, or authentication checks are enforced at the Rouille layer rather than the backend
Under these conditions, a single client connection can result in multiple logical backend requests, some of which Rouille's handlers never see.
This vulnerability appears in Rouille-based services that act as HTTP frontends, reverse proxies, or gateways to upstream servers such as Go's net/http or Python's http.server.
It is relevant when:
- Rouille copies client-supplied header values verbatim into upstream requests
- The backend HTTP implementation interprets bare LF characters in headers as request delimiters
- Access control, routing, or authentication checks are enforced at the Rouille layer rather than the backend
Under these conditions, a single client connection can result in multiple logical backend requests, some of which Rouille's handlers never see.
Exploit preconditions
- Attack surface: Public or internal HTTP endpoints implemented using Rouille that forward requests to upstream servers.
- Required access: Ability to send crafted HTTP requests to the Rouille service; no existing authentication is strictly required if the vulnerable route is publicly reachable.
- Trigger point: Headers whose values are copied directly into the upstream request (for example, custom headers, X-Forwarded-* style fields, or any non-normalized header value).
- Why exploitation is possible: Rouille allows bare line feed characters (0x0A) within header values and forwards them unchanged. Some backend servers treat those embedded line feeds as end-of-header markers and start parsing a new HTTP request, effectively splitting a single client request into multiple backend requests that bypass Rouille's request parsing and access control logic.
- Attack surface: Public or internal HTTP endpoints implemented using Rouille that forward requests to upstream servers.
- Required access: Ability to send crafted HTTP requests to the Rouille service; no existing authentication is strictly required if the vulnerable route is publicly reachable.
- Trigger point: Headers whose values are copied directly into the upstream request (for example, custom headers, X-Forwarded-* style fields, or any non-normalized header value).
- Why exploitation is possible: Rouille allows bare line feed characters (0x0A) within header values and forwards them unchanged. Some backend servers treat those embedded line feeds as end-of-header markers and start parsing a new HTTP request, effectively splitting a single client request into multiple backend requests that bypass Rouille's request parsing and access control logic.
Why this happens
The core issue aligns with CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling').
Rouille parses and validates HTTP requests using one interpretation of header syntax, but then forwards header values verbatim to upstream servers that apply slightly different parsing rules, especially around control characters like bare LF (0x0A).
This mismatch creates a "request confusion" scenario in which a single logical request at the frontend is interpreted as two separate requests by the backend.
Because the second (smuggled) request is never inspected by Rouille's routing or authorization logic, it can carry attacker-controlled methods, paths, and headers, undermining security controls enforced exclusively at the front layer.
The core issue aligns with CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling').
Rouille parses and validates HTTP requests using one interpretation of header syntax, but then forwards header values verbatim to upstream servers that apply slightly different parsing rules, especially around control characters like bare LF (0x0A).
This mismatch creates a "request confusion" scenario in which a single logical request at the frontend is interpreted as two separate requests by the backend.
Because the second (smuggled) request is never inspected by Rouille's routing or authorization logic, it can carry attacker-controlled methods, paths, and headers, undermining security controls enforced exclusively at the front layer.
Potential impact
- Bypassing authentication or authorization checks enforced by Rouille handlers while reaching protected backend paths.
- Accessing internal-only HTTP endpoints that are assumed to be shielded by the Rouille layer.
- Manipulating backend state (e.g., modifying resources, triggering admin operations) via smuggled requests.
- Polluting or poisoning backend caches by injecting crafted requests that are stored and later served to other users.
- Log evasion or log confusion, where backend logs do not align with frontend logs, complicating incident response.
- Bypassing authentication or authorization checks enforced by Rouille handlers while reaching protected backend paths.
- Accessing internal-only HTTP endpoints that are assumed to be shielded by the Rouille layer.
- Manipulating backend state (e.g., modifying resources, triggering admin operations) via smuggled requests.
- Polluting or poisoning backend caches by injecting crafted requests that are stored and later served to other users.
- Log evasion or log confusion, where backend logs do not align with frontend logs, complicating incident response.
General mitigation guidance
Effective mitigation focuses on enforcing consistent and strict HTTP parsing rules at the frontend and reducing trust in client-controlled header content:
- Normalize and validate incoming header values, rejecting or sanitizing control characters such as bare LF, CR, or CRLF sequences within headers.
- Apply a hard filter that disallows request line and header delimiters within header values before forwarding to upstream servers.
- Prefer frontend behavior that fully re-serializes HTTP requests using canonical formatting rather than copying raw header bytes.
- Enforce access control and routing defense-in-depth by applying security checks at both Rouille and the backend where feasible.
- Limit the exposure of powerful or sensitive backend endpoints, ensuring they do not rely solely on frontend controls for protection.
- Configure proxies, load balancers, and backends to apply conservative HTTP parsing modes where available, aligning their behavior with the frontend.
Effective mitigation focuses on enforcing consistent and strict HTTP parsing rules at the frontend and reducing trust in client-controlled header content:
- Normalize and validate incoming header values, rejecting or sanitizing control characters such as bare LF, CR, or CRLF sequences within headers.
- Apply a hard filter that disallows request line and header delimiters within header values before forwarding to upstream servers.
- Prefer frontend behavior that fully re-serializes HTTP requests using canonical formatting rather than copying raw header bytes.
- Enforce access control and routing defense-in-depth by applying security checks at both Rouille and the backend where feasible.
- Limit the exposure of powerful or sensitive backend endpoints, ensuring they do not rely solely on frontend controls for protection.
- Configure proxies, load balancers, and backends to apply conservative HTTP parsing modes where available, aligning their behavior with the frontend.
How teams detect issues like this
Detection often involves a combination of testing and analysis:
- Static analysis and code review: Look for request handling code that:
- Reads client headers and writes them directly to upstream connections
- Allows raw header values to pass without normalization or character filtering
- Constructs upstream requests using string concatenation that might embed CR/LF sequences
- Dynamic testing: Use HTTP request smuggling test suites and scanners to probe for differential parsing behavior between Rouille and backend servers, focusing on bare LF in headers and unusual line termination patterns.
- Logging correlation: Compare frontend (Rouille) request logs with backend logs to identify mismatches in request counts, methods, or paths for a single client connection.
- Policy enforcement: Define secure coding guidelines that forbid control characters in header values and implement automated checks in CI pipelines to flag non-compliant request forwarding logic.
Detection often involves a combination of testing and analysis:
- Static analysis and code review: Look for request handling code that:
- Reads client headers and writes them directly to upstream connections
- Allows raw header values to pass without normalization or character filtering
- Constructs upstream requests using string concatenation that might embed CR/LF sequences
- Dynamic testing: Use HTTP request smuggling test suites and scanners to probe for differential parsing behavior between Rouille and backend servers, focusing on bare LF in headers and unusual line termination patterns.
- Logging correlation: Compare frontend (Rouille) request logs with backend logs to identify mismatches in request counts, methods, or paths for a single client connection.
- Policy enforcement: Define secure coding guidelines that forbid control characters in header values and implement automated checks in CI pipelines to flag non-compliant request forwarding logic.
