GHSA-3g8r-4pfx-jmfh: Netty: STOMP CONNECT Frame Header Injection in Netty

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final (and all prior versions with codec-stomp) | | Component | io.netty.handler.codec.stomp.StompSubframeEncoder | | Vulnerability Type | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: Improper Neutralization of CRLF in HTTP Headers | | Impact | STOMP Header Injection / Authentication Bypass | | CVSS 3.1 Score | 6.5 (Medium) | | CVSS 3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | | Attack Vector | Network | | Attack Complexity | Low | | Privileges Required | Low | | User Interaction | None | | Scope | Unchanged | | Confidentiality Impact | None | | Integrity Impact | High | | Availability Impact | None | 2. Affected Components - io.netty.handler.codec.stomp.StompSubframeEncoder — encodeHeaders() method (lines 174-200) - io.netty.handler.codec.stomp.StompSubframeEncoder — shouldEscape() method (lines 214-216) 3. Vulnerability Description The Netty STOMP codec encoder (StompSubframeEncoder) intentionally skips the escape() function for CONNECT and CONNECTED commands. This means that newline characters (\n) in header values of CONNECT frames are written directly to the output, allowing an attacker to inject additional STOMP headers. Root Cause In StompSubframeEncoder.java, the shouldEscape() method (lines 214-216) explicitly excludes CONNECT and CONNECTED commands from escaping: private static boolean shouldEscape(StompCommand command) { return command != StompCommand.CONNECT && command != StompCommand.CONNECTED; } When shouldEscape() returns false, header values are written without any escaping (line 195): CharSequence headerValue = shouldEscape ? escape(entry.getValue()) : entry.getValue(); ByteBufUtil.writeUtf8(buf, headerValue); // Raw \n written to output buf.writeByte(StompConstants.LF); For other commands (SEND, SUBSCRIBE, etc.), the escape() method