Return to topic cards

Understanding HTTP Request Smuggling

HTTPCybersecurityWeb SecurityVulnerabilitiesRequest Smuggling

HTTP Request Smuggling is a critical vulnerability that occurs due to mismatches in how different web infrastructure components interpret the boundaries of HTTP requests. This can lead to severe issues such as cache poisoning, request failures, and backend pipeline desynchronization.

Key Points

  • Vulnerability Source: Mismatches in interpreting HTTP request boundaries by proxies, load balancers, and servers.
  • Potential Impacts: Cache poisoning, request failures, and backend pipeline desynchronization.
  • Testing Risks: Extreme care is required when testing for this vulnerability on production websites.

How HTTP Request Smuggling Occurs

HTTP Request Smuggling primarily arises from discrepancies in how different servers interpret HTTP request boundaries. For example:

  • Content-Length and Transfer-Encoding Headers: Ambiguities can arise if both headers are present.
  • Server Prioritization: Some components prioritize Content-Length, while others prioritize Transfer-Encoding.
  • Request Interpretation: This discrepancy can lead to one component believing the request has ended while another thinks it's still ongoing, leading to smuggling.

Types of HTTP Request Smuggling

CL.TE

  • Definition: Content-Length/Transfer-Encoding.
  • Exploitation: Attackers exploit discrepancies between how different servers prioritize these headers.

Incorrect Content-Length

  • Definition: When the Content-Length does not match the actual length of the content.

TE.CL

  • Definition: Transfer-Encoding/Content-Length.
  • Exploitation: The front-end server uses the Transfer-Encoding header, while the back-end server uses the Content-Length header.

TE.TE

  • Definition: Transfer-Encoding/Transfer-Encoding.
  • Exploitation: Both front-end and back-end servers use the Transfer-Encoding header, allowing attackers to craft requests with different encodings.

Mitigation Strategies

  • Uniform Header Handling: Ensure all components interpret headers consistently.
  • Embrace HTTP/2: Upgrade to HTTP/2 to reduce vulnerabilities.
  • Ongoing Surveillance and Reviews: Regularly monitor and review your infrastructure.
  • Team Awareness: Educate your team about the risks and mitigation strategies.

Learn More

For more detailed information on HTTP Request Smuggling, consider exploring resources on web security best practices and advanced mitigation techniques.