## https://sploitus.com/exploit?id=5214DD5B-E187-56D0-8FBC-3132C218ADAF
# CVE-2026-33267 — Apache Traffic Server untrusted `@` header → internal metadata spoof
**CVSS 10.0 (Critical)** · CWE-20 · GHSA-jrh6-9hgv-mqm7
## Summary
Apache Traffic Server reserves `@`-prefixed headers (`@Ats-Internal`, `@ICAP-Status`, `@TCPInfo`, ...)
for **internal metadata**: they live in the in-memory header structure but are never serialized
on the wire. In vulnerable versions (9.2.0–9.2.14, 10.1.0–10.1.3) these headers coming from the
**client request** and the **origin response** are not stripped before plugin hooks run
(`TS_HTTP_READ_REQUEST_HDR_HOOK`, `TS_HTTP_READ_RESPONSE_HDR_HOOK`, remap plugins). A remote
attacker can spoof ATS internal metadata; plugins (cache, ACL, header_rewrite, …) may then trust
attacker-controlled internal state — impact depends on the plugins in use.
## Fix
- 9.2.x: commit `a9aee837db` — "CVE-2026-33267: 9.2.x: Strip external @ headers before plugin hooks"
- master/10.1.x: commit `4ab63dbd93` — same fix
- New `HttpTransact::strip_at_headers()` runs **before** `READ_REQUEST_HDR` /
`READ_RESPONSE_HDR` hooks; counters `proxy.process.http.client_request_at_headers_stripped` /
`proxy.process.http.origin_response_at_headers_stripped` added.
## Verification (2026-08-12, RPi5 arm64, Docker)
Custom `at_probe` plugin logging `@` headers at both hooks, plus a raw-socket client
(curl silently drops `@` headers):
| Build | Client-supplied `@Ats-Internal` | Origin-supplied `@Origin-Test` |
|---|---|---|
| **ATS 10.1.2 (vulnerable)** | 🟥 **LEAKED** (plugin observed it) | 🟥 **LEAKED** (8 observations) |
| **ATS 10.1.4 (fixed, built from source)** | ✅ **STRIPPED** ("stripped internal @ header") | ✅ **STRIPPED** |
Negative control on the fixed build: **0** plugin observations (the plugin never sees the headers).
## Usage
```bash
python3 at_headers_spoof.py 127.0.0.1 8080 /
```
Sends `GET /` with `@Ats-Internal: pwned` and `@Another-At: test` over a raw socket and prints the
response head. On vulnerable ATS the custom plugin (or any `@`-metadata-trusting plugin) receives
the spoofed headers; on fixed builds they are stripped before hooks.
## Impact notes
- Public advisories describe the metadata-spoof primitive; the practical RCE chain depends on
which plugin trusts which `@` metadata on the target deployment (e.g. header_rewrite/cache
directives referencing `@` fields).
- This repo demonstrates and verifies the primitive (leak vs. strip) on both vulnerable and fixed
builds.
## References
- Apache advisory: https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d
- GHSA: https://github.com/advisories/GHSA-jrh6-9hgv-mqm7
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33267
- Fix 9.2.x: `a9aee837db` · Fix 10.1.x: `4ab63dbd93`