CVE-2024-45387 — Apache Traffic Server¶

Key facts

CVE-2024-45387 (Apache Software Foundation) is a High vulnerability: Apache Traffic Server. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2024-45387
Severity	High
Vendor	Apache Software Foundation
Product	Apache Traffic Server
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2024/CVE-2024-45387/

Details¶

CVE-2024-45387 (Apache Software Foundation) is a High vulnerability: Apache Traffic Server. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Apache Traffic Server - HTTP Request Smuggling¶

Overview¶

Field	Value
CVE ID	CVE-2024-45387
Severity	High (CVSS 8.1)
Vendor	Apache Software Foundation
Product	Apache Traffic Server
Vulnerability Type	HTTP Request Smuggling
Exploitation	Remote, No Authentication

Description¶

Apache Traffic Server contains an HTTP Request Smuggling vulnerability due to improper handling of chunked transfer encoding. This allows attackers to smuggle malicious requests through proxy servers, potentially bypassing security controls.

Affected Versions¶

Apache Traffic Server 9.0.0 through 9.2.4
Apache Traffic Server 10.0.0 through 10.0.1

Impact¶

Bypass security controls (WAF, authentication)
Cache poisoning
Session hijacking
Cross-site scripting via cached responses
Access to internal systems

¶

Verification Process¶

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)¶

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing¶

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow¶

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage¶

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References¶

https://nvd.nist.gov/vuln/detail/CVE-2024-45387
https://lists.apache.org/thread/

Disclaimer¶

This POC is for educational and authorized security testing only.

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2024-45387, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2024-45387 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2024-45387 - Apache Traffic Server HTTP Request Smuggling Snort Rules
# Severity: High (CVSS 8.1)

# Detect CL.TE smuggling attempts (Content-Length + Transfer-Encoding)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-45387 HTTP Request Smuggling CL.TE Attempt";
    flow:to_server,established;
    content:"Transfer-Encoding"; http_header;
    content:"chunked"; http_header;
    content:"Content-Length"; http_header;
    classtype:web-application-attack;
    sid:2024453871;
    rev:1;
    metadata:cve CVE-2024-45387, severity high;
)

# Detect TE.CL smuggling attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-45387 HTTP Request Smuggling TE.CL Attempt";
    flow:to_server,established;
    content:"Transfer-Encoding"; http_header;
    content:"Content-Length"; http_header;
    pcre:"/Transfer-Encoding[^\r\n]*chunked.*Content-Length/Hsi";
    classtype:web-application-attack;
    sid:2024453872;
    rev:1;
    metadata:cve CVE-2024-45387, severity high;
)

# Detect malformed Transfer-Encoding header
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-45387 Malformed Transfer-Encoding Header";
    flow:to_server,established;
    content:"Transfer-Encoding"; http_header;
    pcre:"/Transfer-Encoding\s*:\s*(?:chunked\s*,|,\s*chunked|chunked[^\r\n]*chunked)/Hi";
    classtype:web-application-attack;
    sid:2024453873;
    rev:1;
    metadata:cve CVE-2024-45387, severity high;
)

# Detect Transfer-Encoding obfuscation with whitespace
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-45387 Transfer-Encoding Obfuscation";
    flow:to_server,established;
    pcre:"/Transfer-Encoding[\t\x0b\x0c]\s*:/Hi";
    classtype:web-application-attack;
    sid:2024453874;
    rev:1;
    metadata:cve CVE-2024-45387, severity high;
)

# Detect HTTP/1.0 with Transfer-Encoding (unusual)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-45387 HTTP/1.0 with Chunked Encoding";
    flow:to_server,established;
    content:"HTTP/1.0"; http_protocol;
    content:"Transfer-Encoding"; http_header;
    content:"chunked"; http_header;
    classtype:web-application-attack;
    sid:2024453875;
    rev:1;
    metadata:cve CVE-2024-45387, severity medium;
)

# Detect double Transfer-Encoding headers
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-45387 Double Transfer-Encoding Header";
    flow:to_server,established;
    content:"Transfer-Encoding"; http_header;
    content:"Transfer-Encoding"; http_header; distance:1;
    classtype:web-application-attack;
    sid:2024453876;
    rev:1;
    metadata:cve CVE-2024-45387, severity high;
)

# Detect cache poisoning via smuggling
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-45387 Potential Cache Poisoning via Smuggling";
    flow:to_server,established;
    content:"Transfer-Encoding"; http_header;
    content:"chunked"; http_header;
    content:"X-Forwarded-Host"; http_header;
    classtype:web-application-attack;
    sid:2024453877;
    rev:1;
    metadata:cve CVE-2024-45387, severity high;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2024-45387 - Apache Traffic Server HTTP Request Smuggling YARA Rules
 * Severity: High (CVSS 8.1)
 */

rule CVE_2024_45387_CL_TE_Smuggling {
    meta:
        description = "Detects CL.TE HTTP Request Smuggling attempts"
        author = "Security Research"
        date = "2024-10-15"
        cve = "CVE-2024-45387"
        severity = "high"

    strings:
        $te = "Transfer-Encoding" ascii wide nocase
        $chunked = "chunked" ascii wide nocase
        $cl = "Content-Length" ascii wide nocase

        // HTTP methods
        $post = "POST " ascii wide
        $put = "PUT " ascii wide

        // Smuggled request indicators
        $smuggle1 = "0\r\n\r\nGET " ascii
        $smuggle2 = "0\r\n\r\nPOST " ascii
        $smuggle3 = "0\r\n\r\nPUT " ascii

    condition:
        ($te and $chunked and $cl) or
        (any of ($smuggle*))
}

rule CVE_2024_45387_TE_Obfuscation {
    meta:
        description = "Detects Transfer-Encoding header obfuscation"
        author = "Security Research"
        date = "2024-10-15"
        cve = "CVE-2024-45387"
        severity = "high"

    strings:
        // Various TE obfuscation techniques
        $te1 = "Transfer-Encoding: chunked, identity" ascii wide nocase
        $te2 = "Transfer-Encoding: identity, chunked" ascii wide nocase
        $te3 = "Transfer-Encoding : chunked" ascii wide nocase  // space before colon
        $te4 = "Transfer-Encoding: chunked\r\nTransfer-Encoding:" ascii wide nocase
        $te5 = /Transfer-Encoding[\t\x0b\x0c]:/ ascii nocase
        $te6 = "Transfer-Encoding: chunked\x00" ascii  // null byte
        $te7 = "Transfer-encoding: cow" ascii nocase  // unknown encoding

        // Double headers
        $double = "Transfer-Encoding:" ascii wide nocase

    condition:
        any of ($te*) or
        #double > 1
}

rule CVE_2024_45387_Malformed_Chunk {
    meta:
        description = "Detects malformed chunked encoding"
        author = "Security Research"
        date = "2024-10-15"
        cve = "CVE-2024-45387"
        severity = "high"

    strings:
        // Invalid chunk sizes
        $chunk1 = /\r\n[g-zG-Z][0-9a-fA-F]*\r\n/ ascii  // invalid hex
        $chunk2 = /\r\n-[0-9]+\r\n/ ascii  // negative size
        $chunk3 = /\r\n[0-9a-fA-F]{10,}\r\n/ ascii  // oversized chunk header

        // Chunk terminator followed by new request
        $term1 = "0\r\n\r\nGET " ascii
        $term2 = "0\r\n\r\nPOST " ascii
        $term3 = "0\r\n\r\nHEAD " ascii

    condition:
        any of them
}

rule CVE_2024_45387_Cache_Poisoning {
    meta:
        description = "Detects potential cache poisoning via HTTP smuggling"
        author = "Security Research"
        date = "2024-10-15"
        cve = "CVE-2024-45387"
        severity = "high"

    strings:
        $te = "Transfer-Encoding" ascii wide nocase
        $chunked = "chunked" ascii wide nocase

        // Cache-related headers in smuggled request
        $cache1 = "X-Forwarded-Host:" ascii wide nocase
        $cache2 = "X-Original-URL:" ascii wide nocase
        $cache3 = "X-Rewrite-URL:" ascii wide nocase
        $cache4 = "X-Override-URL:" ascii wide nocase

        // Script injection in response
        $xss1 = "<script" ascii wide nocase
        $xss2 = "javascript:" ascii wide nocase

    condition:
        ($te and $chunked) and (any of ($cache*) or any of ($xss*))
}

rule CVE_2024_45387_Network_Traffic {
    meta:
        description = "Detects HTTP smuggling in network traffic"
        author = "Security Research"
        date = "2024-10-15"
        cve = "CVE-2024-45387"
        severity = "high"

    strings:
        // HTTP request with both headers
        $http = /(?:POST|PUT|GET)\s+[^\r\n]+\s+HTTP\/1\.[01]/ ascii

        $te = "Transfer-Encoding:" ascii nocase
        $cl = "Content-Length:" ascii nocase

        // End of headers followed by chunked body then new request
        $pattern = /\r\n\r\n[0-9a-fA-F]+\r\n.*?\r\n0\r\n\r\n(?:GET|POST|PUT|HEAD)/ ascii

    condition:
        $http and $te and $cl and $pattern
}

:material-file-download: prevention/yara.yar

# CVE-2024-45387 - Apache Traffic Server HTTP Request Smuggling Prevention for Nginx
# Use as frontend protection

# Reject requests with both Content-Length and Transfer-Encoding
map $http_transfer_encoding $reject_smuggling {
    default 0;
    "~*chunked" 1;
}

server {
    # Strict HTTP parsing
    ignore_invalid_headers on;
    underscores_in_headers off;

    # Block HTTP request smuggling attempts
    if ($http_transfer_encoding ~* "chunked") {
        set $te_header "1";
    }
    if ($content_length != "") {
        set $cl_header "1";
    }
    if ($te_header$cl_header = "11") {
        return 400;
    }

    # Block malformed Transfer-Encoding headers
    if ($http_transfer_encoding ~* "(,|chunked.*chunked|identity.*chunked)") {
        return 400;
    }

    # Normalize chunked encoding - reject double encoding
    if ($http_transfer_encoding ~* "chunked.*,.*chunked") {
        return 400;
    }

    # Block CL.TE and TE.CL smuggling patterns
    location / {
        # Log potential smuggling attempts
        if ($http_transfer_encoding ~* "chunked") {
            access_log /var/log/nginx/smuggling-attempts.log;
        }

        # Limit request body
        client_max_body_size 10M;
        client_body_buffer_size 128k;

        # Strict timeouts
        client_body_timeout 10s;
        client_header_timeout 10s;

        # proxy_pass http://backend;
    }

    # Block HTTP/0.9 and HTTP/1.0 which are more susceptible
    if ($server_protocol ~* "HTTP/0.9|HTTP/1.0") {
        return 400;
    }
}

# Rate limiting for suspicious patterns
limit_req_zone $binary_remote_addr zone=smuggling_limit:10m rate=10r/s;

:material-file-download: prevention/nginx.conf

# CVE-2024-45387 - Apache Traffic Server HTTP Request Smuggling Prevention for Apache HTTPD

# Enable required modules
# LoadModule headers_module modules/mod_headers.so
# LoadModule security2_module modules/mod_security2.so

# Reject requests with both Content-Length and Transfer-Encoding
<IfModule mod_security2.c>
    # Block CL.TE smuggling attempts
    SecRule REQUEST_HEADERS:Transfer-Encoding "chunked" \
        "id:2024453871,phase:1,chain,deny,status:400,\
        msg:'CVE-2024-45387 HTTP Smuggling CL.TE Attempt',\
        logdata:'TE:%{REQUEST_HEADERS.Transfer-Encoding} CL:%{REQUEST_HEADERS.Content-Length}',\
        severity:CRITICAL"
        SecRule REQUEST_HEADERS:Content-Length "!^$" ""

    # Block malformed Transfer-Encoding headers
    SecRule REQUEST_HEADERS:Transfer-Encoding "@rx (?:chunked.*chunked|,\s*chunked|chunked\s*,)" \
        "id:2024453872,phase:1,deny,status:400,\
        msg:'CVE-2024-45387 Malformed Transfer-Encoding',\
        severity:CRITICAL"

    # Block Transfer-Encoding obfuscation
    SecRule REQUEST_HEADERS:Transfer-Encoding "@rx (?:transfer-encoding|Transfer-Encoding)\s*:" \
        "id:2024453873,phase:1,deny,status:400,\
        msg:'CVE-2024-45387 TE Header Obfuscation',\
        severity:HIGH"

    # Block chunked encoding with unusual whitespace
    SecRule REQUEST_HEADERS:Transfer-Encoding "@rx [\t\v\f\r]" \
        "id:2024453874,phase:1,deny,status:400,\
        msg:'CVE-2024-45387 TE Header Whitespace Obfuscation',\
        severity:HIGH"

    # Block requests with multiple Content-Length headers
    SecRule &REQUEST_HEADERS:Content-Length "@gt 1" \
        "id:2024453875,phase:1,deny,status:400,\
        msg:'CVE-2024-45387 Multiple Content-Length Headers',\
        severity:CRITICAL"
</IfModule>

# Strict request handling
<Directory />
    # Reject requests with ambiguous headers
    <If "%{HTTP:Transfer-Encoding} =~ /chunked/i && %{HTTP:Content-Length} != ''">
        Require all denied
    </If>
</Directory>

# Request body limits
LimitRequestBody 10485760
LimitRequestFields 50
LimitRequestFieldSize 8190
LimitRequestLine 8190

# Timeout settings
Timeout 30
KeepAliveTimeout 5

# Logging for monitoring
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Transfer-Encoding}i\" \"%{Content-Length}i\"" smuggling
CustomLog /var/log/httpd/smuggling.log smuggling

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2024-45387?¶