cve/2019/CVE-2019-20372.md

### [CVE-2019-20372](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

### POC

#### Reference
- http://seclists.org/fulldisclosure/2021/Sep/36
- http://seclists.org/fulldisclosure/2021/Sep/36

#### Github
- https://github.com/0xleft/CVE-2019-20372
- https://github.com/ARPSyndicate/cvemon
- https://github.com/SexyBeast233/SecBooks
- https://github.com/ginoah/My-CTF-Challenges
- https://github.com/rmtec/modeswitcher
- https://github.com/vigneshsb403/nginx0-HTTP-smugging
- https://github.com/vuongnv3389-sec/CVE-2019-20372
- https://github.com/woods-sega/woodswiki