CVE-2021-21299: 
Rust vulnerability analysis and mitigation

CVE-2021-21299 is a vulnerability discovered in hyper's HTTP server code that was introduced in version 0.12.0 and patched in versions 0.14.3, 0.13.10, and 0.12.36. The vulnerability allows requests with multiple transfer-encoding headers to be incorrectly interpreted as having a chunked payload, when they should have been rejected as illegal (RUSTSEC Advisory, GitHub Advisory).

The vulnerability occurs when a request contains multiple Transfer-Encoding headers, where hyper would check each header if they ended with 'chunked' instead of only checking the last header. This behavior deviates from RFC 7230 specifications. When combined with an upstream HTTP proxy that interprets the request payload boundary differently, it enables request smuggling or desync attacks. The flaw was introduced in commit 26417fc and affects HTTP/1.1 server implementations (GitHub Advisory).

When exploited, this vulnerability can enable request smuggling attacks, allowing attackers to prepend arbitrary content to legitimate users' requests. This can lead to cache poisoning, credential theft, and request queue manipulation. The vulnerability has been rated as HIGH severity with a CVSS score of 8.1, potentially affecting confidentiality, integrity, and availability of the system (RUSTSEC Advisory).

The vulnerability is exploitable when all of the following conditions are met: using hyper as an HTTP server (client is not affected), using HTTP/1.1 (HTTP/2 is not affected), and having a vulnerable HTTP proxy upstream to hyper. If an upstream proxy correctly rejects illegal transfer-encoding headers, the desync attack cannot succeed (GitHub Advisory).

Besides upgrading to the patched versions (0.14.3, 0.13.10, or 0.12.36), organizations can implement the following workarounds: reject requests containing a transfer-encoding header, or ensure any upstream proxy handles transfer-encoding correctly. The vulnerability can also be mitigated by configuring the front-end server to normalize ambiguous requests before routing them onward (GitHub Advisory).