Advanced Offensive Security
HTTP Request Smuggling
Desync front-end and back-end servers to poison other users' requests.
When a front-end proxy and a back-end server disagree about where one HTTP request ends and the next begins, an attacker can 'smuggle' a partial request that gets prepended to the NEXT user's request — hijacking their session, poisoning caches, or bypassing controls.
The core desync
- CL.TE — front-end uses Content-Length, back-end uses Transfer-Encoding.
- TE.CL — the reverse; back-end trusts Content-Length.
- TE.TE — both use Transfer-Encoding but one can be tricked into ignoring it (obfuscation).
POST / HTTP/1.1
Host: victim
Content-Length: 6
Transfer-Encoding: chunked
0
G <- 'G' is smuggled onto the next request