HTTP Request Smuggling and How to Prevent It

Risk Factors

Likelihood

Complexity

Business Impact

HTTP Request Smuggling

What Is HTTP Request Smuggling?

Websites often rely on load balancers, content delivery networks (CDNs), or reverse proxies to manage incoming HTTP requests over a single connection. HTTP request smuggling is a web application attack that takes advantage of inconsistencies in how front-end servers (proxies) and back-end servers process requests from more than one sender.

This can enable an attacker to bypass security controls and gain access to a site administration page, or open doors for other attack techniques such as cross-site scripting (XSS). HTTP request smuggling is sometimes referred to as HTTP desynchronization.

Here's a simple overview of how the attack works: When a server processes an HTTP request, the server determines the length (beginning and end) of the HTTP content by referring to the Content-Length or Transfer-Encoding headers. If both of these headers are present in the same request, they might provide conflicting information. To prevent a conflict, a server will ignore one of the headers.

However, a front-end proxy server might ignore a different header than a back-end server. HTTP request smuggling attacks include both headers in a request, followed by more inbound HTTP requests that are chained together in one HTTP connection. This causes a problem in how front-end and back-end servers determine the beginning and end of each request in the chain. The end of a malicious HTTP request is miscalculated, leaving malicious content unprocessed by one server and then added to the beginning of the next inbound request in the chain.


Protection Against HTTP Request Smuggling

Certain IT optimizations can leave systems vulnerable to HTTP smuggling, such as the reuse of back-end server connections. Disabling reuse forces each request to be sent over a separate connection, reducing risk of HTTP desynchronization. Using HTTP/2 on back-end servers may also help mitigate unauthorized requests, as the protocol helps prevent ambiguity. Finally, many web application firewalls may help identify and block inconsistencies in HTTP request traffic, mitigating any potentially smuggled requests. Unfortunately, firewalls may also serve as a mechanism for smuggling.


HTTP Request Smuggling History

HTTP request smuggling was first reported in 2005 in a paper published by the security software provider Watchfire. In 2020, researchers at SafeBreach, (which included Armit Klein, one of the original authors of the Watchfire paper) discovered new variants of the attack that use identical vulnerabilities in both proxy servers and back-end servers. While there are no known proof-of-concept exploits of these newly discovered variants, the consequences of the exploits have been deemed dire for businesses and several software vendors have released patches.