Full Report
HTTP Smuggling is an attack that attempts to smuggle in HTTP requests to bypass security controls. Most of the time, this comes down to a misunderstanding of the HTTP protocol between two endpoints. However, this can come down to abnormalities in an implementation as well. This is going to be a plethora of things that don't feel like that go together lolz. A connection can be reused in HTTP. The author found that the HOST header was only validated in the first of the connections but not future ones. Another trick was that the Amazon Application Load Balancer was automatically forwarding the Transfer-Encoding: chunked header if the CL header wasn't there in HTTP. Since browsers automatically add this header with HTTP/2 anyway (even if it's not required) this caused a trivial desync. The surprise on this is unreal! In some cases, the server completely ignores some headers. While testing a site for this (CL.0 smuggling), the front-end will use the CL but the back-end doesn't care. This led to a very simple attack where the back-end would see the second request from a server as the body of the first request. What's freaky, is that this could be done via a browser! The above attack was possible because the service wasn't expecting a POST request at all. The author decided to check in other locations where this desync could be possible. They found that amazon.com/b was vulnerable to this attack, leading to the response queue getting poisoned. This allowed them to get authentication tokens by receiving the wrong response. Client-side smuggling had been born - a request to a single server (with nothing else running) to make something bad happen. Even worse, some of these can be called from the browser, making a drive-by CSRF attack possible with this. A CSD vector is a HTTP request with two key properties. First, the CL must be ignored. THis can happen with errors (long URLs, weird encoding, etc.) or a POST request that wasn't expected. Secondly, a web browser must be enable to trigger this cross-domain, which is limited by the amount of things we have access to in the browser. The trick to determining if the CL is not being used is to use an overlong Content Length. If this returns fine, then you may have an issue. To further determine if you have found a bug, send multiple HTTP requests down this pipeline to send multiple requests at once. The article includes a nice script for the Chrome dev tools to see if you have found a problem via Connection Id tracking. With the Connection pool poisoned on a cross-origin request, what can we do? If the website has user storage, then using the end of one request to save a victims request would allow for the saving of cookies and other things. Because we can poison the response queue, we can launch things like header XSS and other things. A real world case study was Akamai ignores CL headers on a redirect. By making a POST request to this endpoint, the queue is poisoned, since the BODY of the message is ignored. The first complication is the redirect getting followed; this can be stopped by disabling CORS to resolve an error. The second problem is that browsers will discard the connection if too much data is received. To get around this, make the request take more time by adding a cache buster in it. Another case study shows a client side cache poisoning using the smuggling method for JavaScript files. By sending back the poisoned file once and then navigating to this page, we can add our own JavaScript to the page. The author found another form of desync by pausing connections as well by abusing misguided request-timeout implementations. There are tons of way to desync HTTP servers, with this being explored from previous posts. There are many other ways to cause these issues and exploit them in the future. Absolutely amazing research!
Analysis Summary
# Technique: HTTP Request Smuggling (including Client-Side Smuggling)
## Overview
HTTP Request Smuggling is an exploitation technique that takes advantage of discrepancies in how different HTTP devices (such as load balancers, reverse proxies, and back-end servers) interpret and process HTTP request boundaries. By desynchronizing the stream of requests, an attacker can "smuggle" a hidden request inside a legitimate one, leading to security control bypass, unauthorized data access, and session hijacking.
## Technical Details
- **Type:** Technique (Exploitation of Protocol Implementation)
- **Platform:** Web Servers, Load Balancers (ALB, Akamai), Browsers (Chrome)
- **Capabilities:** Response queue poisoning, credential theft, bypass of security filters, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF).
- **First Seen:** Variant-dependent; Client-Side Desync (CSD) research is contemporary.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application
- **TA0006 - Credential Access**
- T1557 - Adversary-in-the-Middle (via Response Queue Poisoning)
- **TA0005 - Defense Evasion**
- T1071.001 - Application Layer Protocol: Web Protocols (Bypassing WAF/Proxy)
## Functionality
### Core Capabilities
- **CL.0 Smuggling:** Occurs when a front-end server uses the `Content-Length` (CL) header, but the back-end server ignores it. This causes the back-end to treat the smuggled second request as part of the first request's body or the start of a subsequent request.
- **Connection Reuse Exploitation:** Misusing persistent HTTP connections where security headers (like `HOST`) are validated on the initial request but ignored on subsequent piped requests.
- **Header Desync:** Exploiting variations in `Transfer-Encoding: chunked` vs. `Content-Length` handling, particularly in HTTP/2 to HTTP/1.1 conversions.
### Advanced Features
- **Client-Side Desync (CSD):** A specialized vector where a browser can be forced to trigger the desync cross-domain. It requires the server to ignore the `Content-Length` (often due to errors, long URLs, or unexpected POSTs).
- **Response Queue Poisoning:** Desynchronizing the TCP connection so that a victim receives a response intended for the attacker, or vice versa, allowing for the theft of authentication tokens and cookies.
- **Browser-Based CSRF:** Leveraging smuggled requests to perform actions on behalf of a user even when standard CSRF protections are in place.
- **Client-Side Cache Poisoning:** Using smuggling to deliver malicious JavaScript files to the browser cache.
## Indicators of Compromise
- **File Names:** Chrome Dev Tools scripts for Connection ID tracking (used by researchers/attackers).
- **Network Indicators:**
- `amazon[.]com/b` (Identified vulnerable endpoint in case study).
- Out-of-order HTTP responses relative to requests.
- Presence of both `Content-Length` and `Transfer-Encoding` headers in single requests (specifically those manipulated to bypass filters).
- **Behavioral Indicators:**
- Multiple HTTP requests packed into a single TCP segment.
- Abnormally long `Content-Length` values that do not match the actual body size.
- High frequency of 400-level errors or unexpected redirects on POST requests.
## Associated Threat Actors
- Primarily used by security researchers and advanced persistent threat (APT) actors for stealthy data exfiltration and initial access.
## Detection Methods
- **Behavioral Detection:** Monitoring for "overlong" Content-Length headers that do not result in server-side errors.
- **Connection Tracking:** Monitoring for multiple unique HOST headers within a single persistent TCP connection.
- **Anomaly Detection:** Identifying discrepancies in request processing times (e.g., using cache busters to keep connections open during smuggling).
- **Tooling:** Using specialized scripts in browser developer tools to track `ConnectionId` to see if requests are leaking across different sessions.
## Mitigation Strategies
- **Normalization:** Ensure all servers in the chain (front-end and back-end) interpret HTTP headers consistently.
- **Disable Connection Reuse:** Disabling HTTP keep-alive or connection pooling can prevent desynchronization, though this impacts performance.
- **Protocol Upgrade:** Prioritize end-to-end HTTP/2 or HTTP/3 to reduce reliance on legacy CL/TE parsing.
- **Header Validation:** Reject requests containing both `Content-Length` and `Transfer-Encoding` headers.
- **WAF Configuration:** Use Web Application Firewalls specifically tuned to detect and block ambiguous HTTP request structures.
## Related Tools/Techniques
- **HTTP Request Tunneling**
- **HTTP Response Splitting**
- **CL.TE / TE.CL / TE.TE Smuggling**
- **Cross-Site Request Forgery (CSRF)**