blaze-server Header-Sanitization Bypass: Early Warning
An early warning has been issued regarding a potential vulnerability in blaze-server that could allow an unauthenticated remote client to inject arbitrary header names and values, bypassing header-based trust decisions in the application.
What happened
Reportedly, blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Since trailer fields are attacker-controlled, this appears to enable an unauthenticated remote client to inject headers that a fronting proxy may have sanitized from the request-header section. This issue is under investigation and has been tracked under GHSA-46Q4-43PH-C6FR.
Professional software engineers using blaze (maven) are advised to assess their exposure. The recommended interim action is to deploy blaze-server behind a proxy that removes trailer fields (or rejects requests that use trailers) before forwarding. Until a patch is available, avoid making trust decisions based on headers that a proxy is relied upon to sanitize.
For more detailed information, primary sources should be consulted. The severity of this issue is currently assessed as high, and the incident is being actively investigated.
How 0Day mitigates this
blaze is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.