GHSA-fxhh-mj9j-w84f: 
JavaScript vulnerability analysis and mitigation

Summary

In forward mode (plain HTTP, direct or through an HTTP or SOCKS upstream), proxy-chain de-chunked an inbound request body and wrote it to the upstream without framing. Node's HTTP client does not chunk outbound bodies on GET, HEAD, DELETE, or OPTIONS by default, and the proxy had already stripped the inbound Transfer-Encoding header as hop-by-hop, so the body reached the upstream with neither Content-Length nor Transfer-Encoding. An upstream server or upstream proxy parsed those bytes as a second request.

Details

A proxy client sends a GET with Transfer-Encoding: chunked whose chunked body contains a complete second HTTP request. The proxy calls prepareRequestFunction for the outer request only, forwards it, and the smuggled request follows on the same upstream connection without ever being seen by the hook. Because the outbound connection comes from Node's shared keep-alive agent, the response to the smuggled request can be delivered to a different client of the same proxy. The relevant code is the headers option of the outbound request in src/forward.ts and src/forward_socks.ts, built from validHeadersOnly(request.rawHeaders), which drops Transfer-Encoding. Affected: all 2.x and 3.x releases before 3.0.2. Fixed in 3.0.2 (#738): when the inbound request carried Transfer-Encoding, the outbound request is sent with transfer-encoding: chunked and any Content-Length removed, so the body stays framed as a body.

Proof of concept

Run a proxy with a prepareRequestFunction that allows allowed.example and rejects internal.example, forwarding through an upstream HTTP proxy. Send on one connection:

GET http://allowed.example/ HTTP/1.1
Host: allowed.example
Transfer-Encoding: chunked
<chunk size in hex>
GET http://internal.example/secret HTTP/1.1
Host: internal.example
0

The upstream receives two requests. The second one reaches internal.example even though prepareRequestFunction rejects that host, and the hook is called only once.

Impact

HTTP request smuggling (CWE-444). A proxy client can send requests that bypass the operator's prepareRequestFunction allow or deny logic, and can inject a response into another client's request on a shared upstream connection. Affects operators of proxy-chain servers that accept plain HTTP requests, and their clients.