VDE-2022-014 — PHOENIX CONTACT: mGuard Device Manager affected by HTTP Request Smuggling of Apache Webserver

Summary

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling.
For the mGuard Device Manager only the mdm Installer for Windows is affected.

Details

Impact
Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles ('ATV profiles'). Such configuration profiles may contain sensitive information, e.g., private keys associated with IPsec VPN connections.

Mitigation
This vulnerability is exploitable only if the ConfigPull functionality is used and config files are stored unencrypted. As a best practice and mitigation measure, we recommend storing configuration files encrypted with the device specific public key of the mGuard appliances.

Remediation
PHOENIX CONTACT strongly recommends upgrading FL MGUARD DM UNLIMITED to version 1.13.0.2 or higher, which fixes this vulnerability.

Vulnerabilities 1

Unscored —

CVE-2022-22720 Public exploit EPSS 28%

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Mar 14, 2022

Revision history

2025-05-22 #2
Fix: added distribution, quotation mark
2022-04-12 #1
Initial revision.

References

PHOENIX CONTACT PSIRT
https://phoenixcontact.com/psirt
CERT@VDE Security Advisories for PHOENIX CONTACT
https://certvde.com/en/advisories/vendor/phoenixcontact/
VDE-2022-014: PHOENIX CONTACT: mGuard Device Manager affected by HTTP Request Smuggling of Apache Webserver - HTML
https://certvde.com/en/advisories/VDE-2022-014/