Full Report
James Kettle reopened the desync/smuggling vulnerability in the last two years. While doing so, he has an interesting set of notes on finding bugs. The amount of bug available is based on a few things: How well understood or explained is a bug? How complex is the system or bug? How obscure or known is the bug class? The bugs exist with complex, obscure and poorly explained issues. If you're looking at SQL injection on a popular website, there will be heavy competition on it. If you're looking for Web Cache Deception, a bug class from a few years ago, then you'll have less competition. Where the good opportunities in research? Most of my stuff is passed upon others, as James alludes too. They have a few points: Did the researcher miss anything? Did they release a scanning tool? If not, can I make one? If they did release a scanner, does it detect every vulnerability mentioned in the paper? Can I see any blind spots in their scanner's design or code? The example that James gives is on his own research on desync attacks. They mentioned that CL.0 style vulnerabilities were mentioned in the presentation, with several obfuscated payloads to make it possible. However, these were never added to the scanning tool. James added these to the scanning tool and instantly found 15 unique bug bounty programs vulnerable to this type of desync. They claim that added new permutations is the easiest way to find fresh desync vulnerabilities. Overlooked research is an easy way to find new bugs. Most people simply use current techniques to find bugs. Overall, good write up!
Analysis Summary
# Best Practices: Exploiting and Defending Against Request Desync (HTTP Smuggling)
## Overview
These practices address the identification and mitigation of HTTP Request Smuggling and Desync vulnerabilities. The focus is on leveraging "overlooked research"—identifying gaps in existing security tooling and research papers to find vulnerabilities that standard scanners miss, specifically focusing on complex permutations like CL.0 style attacks.
## Key Recommendations
### Immediate Actions
1. **Audit Scanning Tool Capabilities:** Review current DAST (Dynamic Application Security Testing) tools to see if they include recent desync payloads (e.g., CL.0, TE.CL, CL.TE).
2. **Verify Payload Coverage:** If using open-source scanners like HTTP Request Smuggler, manually verify if the obfuscated payloads mentioned in James Kettle’s research papers are actually enabled in your configuration.
3. **Prioritize Obscure Bug Classes:** Shift focus from highly competitive/well-understood bugs (like standard SQLi) to complex, poorly explained issues like Web Cache Deception and advanced Desync permutations.
### Short-term Improvements (1-3 months)
1. **Custom Plugin Development:** Develop or modify custom scripts/plugins for your scanners that specifically include "missed" permutations from research papers (e.g., adding obfuscated headers that the original researcher didn't automate).
2. **Gap Analysis of Research:** Task your security team with reading foundational research papers (like Kettle’s) and identifying "blind spots"—vulnerabilities mentioned in text but not included in the released scanning tools.
3. **Permutation Testing:** Implement a testing phase that focuses on header variations (e.g., `Transfer-Encoding: xchunked`, `Content-Length: 0` alongside body content) to identify CL.0 vulnerabilities.
### Long-term Strategy (3+ months)
1. **Research-Driven Bug Hunting Program:** Establish a workflow that treats new academic/industry research as a source for custom detection signatures rather than relying on vendor updates.
2. **Modernize Infrastructure:** Move toward end-to-end HTTP/2 or HTTP/3 where possible to reduce the risk of desync between frontend and backend servers caused by differing HTTP/1.1 parsing logic.
3. **Automated Regression for Desync:** Build a library of successful desync payloads found during research and run them against every new deployment to ensure "permutation rot" doesn't occur.
## Implementation Guidance
### For Small Organizations
- Focus on using free, high-quality tools (e.g., Burp Suite Community with the HTTP Request Smuggler extension).
- Manually test critical paths (login, payment) using the latest research-based payloads.
### For Medium Organizations
- Allocate time for a "Research Review" sprint once a quarter to update your internal scanning dictionaries with new permutations found in the wild.
- Implement a WAF that is specifically tuned to catch `Transfer-Encoding` obfuscation.
### For Large Enterprises
- Create a dedicated "Exploit Development" team to turn theoretical research (e.g., obscure desync attacks) into internal automated scanning capabilities.
- Audit your entire load balancer and reverse proxy stack for parsing inconsistencies (Desync).
## Configuration Examples
To prevent CL.0 and general desync attacks:
- **Disable Header Reuse:** Configure frontend proxies to strictly normalize incoming requests.
- **Reject Ambiguous Requests:** Reject any request containing both `Content-Length` and `Transfer-Encoding` headers.
- **Example (Nginx):** Ensure `proxy_http_version 1.1;` and set `proxy_set_header Connection "";` to prevent certain types of connection-based desync.
## Compliance Alignment
- **NIST SP 800-53:** RA-5 (Vulnerability Scanning) and SI-10 (Information Input Validation).
- **OWASP Top 10:** A04:2021-Insecure Design and A06:2021-Vulnerable and Outdated Components.
- **ISO/IEC 27001:** Control A.12.6.1 (Management of technical vulnerabilities).
## Common Pitfalls to Avoid
- **Tool Complacency:** Assuming that because a "Desync Scanner" was run, all desync bugs are found. Most tools miss obfuscated permutations.
- **Ignoring "Old" Research:** Dismissing research from 2-3 years ago as "fixed." Many bug classes (like Web Cache Deception) remain prevalent due to lack of competition.
- **Focusing on Low-Hanging Fruit:** Wasting resources on SQLi or XSS in areas where automated scanners are already highly efficient.
## Resources
- **Research:** James Kettle (PortSwigger) - "HTTP Desync Attacks: Request Smuggling Reborn"
- **Tooling:** Burp Suite HTTP Request Smuggler [github[.]com/PortSwigger/http-request-smuggler]
- **Learning:** PortSwigger Web Security Academy - HTTP Request Smuggling Labs