Assessment of HTTP/1.1 Request Smuggling Vulnerability in VMware NSX

Products

• VMware NSX

Issue/Introduction

This article addresses concerns regarding the HTTP/1.1 Request Smuggling vulnerability and its applicability to VMware NSX environments.

The HTTP/1.1 protocol is inherently susceptible to HTTP Request Smuggling attacks. If exploited, a desynchronization between front-end and back-end servers can cause the system to lose track of which responses belong to specific users. This can result in massive disclosures of confidential information, typically manifesting as users being randomly logged into other live users' accounts.

•  Does any VMware NSX service use HTTP/1.1 in any capacity?

On VMware NSX, HTTP/1.1 is disabled by default for inbound connections. If it was previously enabled for custom configuration requirements, it can be explicitly disabled to prevent exposure.

• What is the impact?

If HTTP/1.1 request smuggling is successfully executed, the impact is severe, primarily leading to unauthorized data exposure, session hijacking, and cross-user data contamination (e.g., viewing or interacting with another user's active session).

• Is there a remediation plan for this vulnerability?

Because the protocol behavior is disabled by default for inbound traffic, a standard NSX deployment is not vulnerable. For existing environments where HTTP/1.1 inbound connections were manually permitted, the remediation plan is to disable HTTP/1.1 inbound processing.

Environment

VMware NSX 

Cause

The risk is only present if inbound HTTP/1.1 traffic processing is explicitly allowed. VMware NSX mitigates this risk out-of-the-box by disabling HTTP/1.1 for inbound connections by default.

Resolution

• Check Security Advisories: Review the Broadcom Security Advisory Portal to cross-reference your specific NSX version against documented CVEs. As HTTP/1.1 is disabled by default, no standard CVEs currently impact default deployments for this specific protocol behavior.

• Verify Configuration: Ensure that your NSX deployment maintains its default state and that inbound HTTP/1.1 processing has not been manually enabled.

• Contact Support: If you believe your environment is exposed or if you require configuration validation, please reach out directly to the Broadcom Technical Support team for assistance.

Additional Information

Check VMware security advisory https://support.broadcom.com/web/ecx/security-advisory for all CVEs