HTTP Request Smuggling

high Web App Scanning Plugin ID 114223

Language:

Synopsis

Description

Modern web applications are often deployed with a chain of HTTP servers which ensure the transmission of the HTTP traffic from users to the service. Typical deployments include the usage of a front-end server, usually a load balancer or a reverse proxy, which will then transmit the requests to one or more back-end servers.

HTTP request smuggling occurs when the front-end server and the back-end server show discrepancies in the way they process HTTP requests `content-length` and `transfer-encoding` headers. A remote and unauthenticated attacker can leverage this class of vulnerability to bypass access controls or gain access to sensitive data, or to compromise offer users traffic without interaction.

Solution

If possible, only use HTTP/2 protocol and ensure that HTTP downgrading is disabled. Ensure that the parsing of HTTP requests is consistent on the whole HTTP transmission chain and that all the intermediate software used are up-to-date.