HTTP Desync Attack

HTTP Request Smuggling is an attack technique that leverages weaknesses in how back-end systems interpret specially designed HTTP requests. HTTP Desync leverages weaknesses in how front-end systems, such as load balancers, interpret multiple HTTP requests. An attacker creates a specially designed HTTP POST request with headers that contain chunked encoded messages (a Content-Length and Transfer-Encoding parameter with content). These chunked messages can desynchronize how front-end and back-end systems for a website distinguish the beginning and end of consecutive incoming HTTP requests. First, the attacker sends the malicious POST request to a website (1). The front-end load balancer stops parsing the request after the Content-Length is reached, and the malicious Transfer-Encoding content remains in the connection (2). This malicious content is prepended to the next legitimate HTTP request sent through the shared connection, and then pushed to the back-end web server (3). Depending on how the web server processes the malicious content, the website user who sent the legitimate request then receives the malicious content instead of, or in addition to, the web page they requested.