Varnish forwards HTTP/1.1 requests with invalid methods

[kenballus]

Expected Behavior

The HTTP RFCs specify that request methods must consist only of the following characters:

"!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA

Current Behavior

Varnish doesn't enforce this rule. Instead, it accepts and forwards methods containing the following disallowed bytes:

• "
• (
• )
• ,
• /
• :
• ;
• <
• =
• >
• ?
• @
• [
• \\
• ]
• {
• }
• The full range from \x80 to \xff.

Possible Solution

Reject all requests containing disallowed bytes in methods.

Steps to Reproduce (for bugs)

1. Start Varnish
2. Send it a request with a super invalid method:

printf '"(),/:;<=>?@[\\]{}\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff / HTTP/1.1\r\nHost: a\r\n\r\n'' | ncat localhost 80

3. Observe that it gets forwarded as-is.

Context

I am differential testing HTTP implementations to find request smuggling vulnerabilities. While I have not demonstrated that this bug is exploitable, I figured that you might be interested.

Varnish Cache version

varnishd (varnish-trunk revision f778ad5b986fadaa22dbec3a0ac49cab3076c81b) Copyright (c) 2006 Verdens Gang AS Copyright (c) 2006-2025 Varnish Software Copyright 2010-2025 UPLEX - Nils Goroll Systemoptimierung

Operating system

Debian 13

Source of binary packages used (if any)

No response

[nigoroll]

bugwash:

• we should check as per rfc in core code (as part of validate headers)
• for 8.0, we should update builtin.vcl to only accept well known methods at all and not just return(pipe) for anything unknown

[DemiMarie]

@kenballus Want to collaborate? I was doing the same thing, but mostly with HTTP/2 and HTTP/3!

[DemiMarie]

At least it isn’t as bad as libsoup, which allows CR and LF in request methods and URIs!

[kenballus]

Yep! And it's not just Libsoup :)

We have a tool for finding these kinds of bugs over at https://github.com/narfindustries/http-garden

I'd be happy to collaborate; send me an email!

We have some research funding to add support for HTTP/2 and HTTP/3 over the summer; I'd be really interested to learn from what you're working on.

[DemiMarie]

Sure! Which email should I use @kenballus?

[kenballus]

Oops! It's on https://kallus.org, at the bottom of the page :)

[nigoroll]

bugwash: @walid-git will implement this week

[walid-git]

PR is here: https://github.com/varnishcache/varnish-cache/pull/4381 I just need to update it

[walid-git]

just merged https://github.com/varnishcache/varnish-cache/pull/4381