Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Websites often rely on load balancers, content delivery networks (CDNs), or reverse proxies to manage incoming HTTP requests over a single connection. These systems increase the risk of an HTTP Desync attack, which is similar to an HTTP Request Smuggling attack. A remote, unauthenticated attacker can manipulate HTTP headers to push unexpected content to website visitors. Website visitors can be exposed to phishing attacks, stolen cookies, cross-site scripting attacks, and malware.
Kill Chain
Risk Score
88
HTTP Request Smuggling is an attack technique that leverages weaknesses in how back-end systems interpret specially designed HTTP requests. HTTP Desync leverages weaknesses in how front-end systems, such as load balancers, interpret multiple HTTP requests. An attacker creates a specially designed HTTP POST request with headers that contain chunked encoded messages (a Content-Length and Transfer-Encoding parameter with content). These chunked messages can desynchronize how front-end and back-end systems for a website distinguish the beginning and end of consecutive incoming HTTP requests. First, the attacker sends the malicious POST request to a website (1). The front-end load balancer stops parsing the request after the Content-Length is reached, and the malicious Transfer-Encoding content remains in the connection (2). This malicious content is prepended to the next legitimate HTTP request sent through the shared connection, and then pushed to the back-end web server (3). Depending on how the web server processes the malicious content, the website user who sent the legitimate request then receives the malicious content instead of, or in addition to, the web page they requested.
Configure front-end servers to communicate with back-end servers over HTTP/2
Disable HTTP persistent connection on back-end systems unless required
