Apache HTTP Server AJP Smuggling (CVE-2022-26377): Anatomy of a High-Impact Proxy Flaw

Introduction

A single malformed HTTP header can open a path to the backend, slipping past authentication and other controls in one request. CVE-2022-26377 is a high-severity flaw in Apache HTTP Server's mod_proxy_ajp module, and it shows what protocol desynchronization can do to a web stack. Attackers have used it to smuggle unauthorized requests into backend AJP servers, affecting Apache deployments and enterprise products that bundle Apache, including NetApp ONTAP and IBM QRadar.

About the parties involved:

• Apache Software Foundation: Maintains the Apache HTTP Server, one of the most widely deployed web servers.
• NetApp: A data management and storage vendor whose products run in large enterprises and cloud environments.
• IBM: A technology company whose HTTP Server and QRadar SIEM products are used in critical infrastructure.

Technical Information

Vulnerability Mechanism

CVE-2022-26377 comes from inconsistent parsing of HTTP request headers between Apache HTTP Server's mod_proxy_ajp module and the backend AJP (Apache JServ Protocol) server. The flaw affects Apache HTTP Server versions 2.4.0 through 2.4.53 when mod_proxy_ajp is enabled and configured to forward requests to an AJP backend such as Tomcat.

Exploitation Details

• Trigger: The attacker sends an HTTP request with a malformed or duplicated Transfer-Encoding: chunked, chunked header.
• Apache behavior: Apache strips the Content-Length header but does not properly validate the non-standard Transfer-Encoding value.
• Result: The body of the HTTP request can carry additional, attacker-controlled AJP packets.
• Backend behavior: The backend AJP server, such as Tomcat, may read these as separate requests, which is the smuggling.

This discrepancy lets an attacker inject hidden requests that bypass frontend security controls. Possible outcomes include:

• Unauthorized access to backend applications
• Session hijacking via cookie injection
• Cache poisoning
• Cross-site scripting (XSS) propagation

Example Attack Flow

POST /target HTTP/1.1
Host: vulnerable-server
Transfer-Encoding: chunked, chunked
Content-Length: 524

[malicious AJP packet here]

The backend AJP server may process the malicious AJP packet as a separate, valid request, which lets the attacker reach internal resources or escalate privileges.

Affected Configurations

• Apache HTTP Server with mod_proxy_ajp enabled
• Backend AJP servers such as Tomcat and IBM WebSphere
• Enterprise deployments and products that use Apache as a frontend proxy

Attack Vectors

• Direct exploitation by sending crafted HTTP requests to vulnerable Apache servers
• Chained attacks that use public proof-of-concept code to target downstream products such as IBM QRadar and NetApp ONTAP
• Automated exploitation through offensive security frameworks

Patch Information

Apache HTTP Server version 2.4.64 fixes several vulnerabilities:

• HTTP Response Splitting (CVE-2024-42516): Validates and sanitizes response headers
• SSRF with mod_headers (CVE-2024-43204): Applies stricter validation of header modifications
• SSRF on Windows Due to UNC Paths (CVE-2024-43394): Restricts the server's handling of UNC paths from untrusted sources
• mod_ssl Error Log Variable Escaping (CVE-2024-47252): Escapes all log variables
• mod_ssl Access Control Bypass (CVE-2025-23048): Enforces stricter session validation
• mod_proxy_http2 Denial of Service (CVE-2025-49630): Improves input validation
• mod_ssl TLS Upgrade Attack (CVE-2025-49812): Removes support for TLS upgrades in certain contexts
• HTTP/2 DoS by Memory Increase (CVE-2025-53020): Releases memory resources sooner

Upgrade guidance:

• Upgrade to Apache HTTP Server 2.4.64 to remediate CVE-2022-26377 and the related vulnerabilities above.

Patch source: Apache HTTP Server Security Vulnerabilities

Detection Methods

Detecting request smuggling like CVE-2022-26377 takes more than one method, because the attack is subtle. The bug comes from Apache's mod_proxy_ajp module and the AJP server reading HTTP request headers differently. An attacker can use that gap to smuggle requests, which can lead to unauthorized actions or data manipulation.

Indicators of compromise (IoCs):

• Anomalous log entries: Look for requests in server logs that carry multiple or conflicting Content-Length and Transfer-Encoding headers. These discrepancies can signal a smuggling attempt.
• Unexpected 4xx or 5xx responses: A spike in client errors (4xx) or server errors (5xx) with no matching legitimate requests may mean smuggled requests are causing odd behavior.
• Unusual backend behavior: Watch for actions on backend systems that do not match any logged frontend request, which can mean smuggled requests are being processed.

Detection strategies:

1. Log analysis: Review server logs for header irregularities, especially duplicate or conflicting Content-Length and Transfer-Encoding headers. Automated log tools can help find these patterns.
2. Traffic inspection: Use network monitoring tools with deep packet inspection to check HTTP traffic for signs of smuggling.
3. Security testing: Use scanners and penetration testing tools that test for HTTP request smuggling. These can simulate attacks to surface weaknesses.
4. Web application firewalls (WAFs): Configure WAFs to detect and block malformed HTTP requests used in smuggling. Keep the WAF rules current and tuned to request-smuggling patterns.

Monitoring guidance:

• Regular updates: Keep the web server and proxy configurations on the latest versions, since patches for known vulnerabilities ship in updates.
• Configuration reviews: Audit server and proxy configurations so they follow security practices and do not allow inconsistent request parsing.
• Incident response planning: Keep an incident response plan with procedures for detecting, analyzing, and mitigating HTTP request smuggling attacks.

Detection source: GitHub PoC and Analysis

Affected Systems and Versions

• Apache HTTP Server: Versions 2.4.0 through 2.4.53 with mod_proxy_ajp enabled
• NetApp Clustered Data ONTAP: Affected via bundled Apache HTTP Server
• IBM HTTP Server and QRadar: Affected via inherited Apache codebase
• Fedora Linux: Fedora 35/36 with vulnerable Apache packages
• Other downstream products: Any software or appliance using Apache HTTP Server with mod_proxy_ajp in the vulnerable version range

Vendor Security History

• Apache: A mature disclosure process and relatively prompt patch cycles for high-severity issues. The fix for CVE-2022-26377 shipped in version 2.4.54 within a few months of discovery. Earlier HTTP parsing and request smuggling issues have been reported and patched, which shows how tricky proxy protocol handling is.
• NetApp and IBM: Both vendors issued advisories and patches after disclosure. NetApp released NTAP-20220624-0005, and IBM updated its QRadar and HTTP Server products.

References

• NVD Entry for CVE-2022-26377
• MITRE CVE Entry
• Apache HTTP Server Security Vulnerabilities
• GitHub PoC and Analysis
• NetApp Advisory NTAP-20220624-0005
• IBM Security Bulletin
• WatchTowr Labs QRadar Analysis
• Praetorian F5 BIG-IP Smuggling Analysis

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]