CVE-2025-3110
Description
A flaw in OpenVPN Access Server allows remote attackers to smuggle HTTP requests when the server operates behind a reverse proxy. The issue stems from the server accepting unstandardized bare line-feed sequences in HTTP headers.
Statement
A Moderate flaw in OpenVPN Access Server allows remote HTTP request smuggling when deployed behind a reverse proxy. This occurs because the server improperly accepts bare line-feed sequences in HTTP headers, causing proxy misinterpretation.
Mitigation
To mitigate this issue, ensure that any reverse proxy deployed in front of OpenVPN Access Server is configured to strictly validate and normalize HTTP header fields, specifically rejecting or sanitizing bare line-feed sequences. Alternatively, consider restricting direct network access to the OpenVPN Access Server, bypassing the reverse proxy, if your deployment architecture allows for it without compromising other security requirements. Consult your reverse proxy's documentation for specific configuration options related to HTTP header parsing and normalization. Any changes to proxy configurations may require a service reload or restart to take effect, which could temporarily interrupt service.
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
