[saag] fwd: HTTP Desync Attacks: Request Smuggling Reborn

[Yakov Shafranovich <[e-mail]>]

Abstract:
"HTTP requests are traditionally viewed as isolated, standalone
entities. In this paper, I'll explore forgotten techniques for remote,
unauthenticated attackers to smash through this isolation and splice
their requests into others, through which I was able to play puppeteer
with the web infrastructure of numerous commercial and military
systems, rain exploits on their visitors, and harvest over $70k in bug
bounties."

There were presentations at BlackHat and DefCon. Details here:
https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn

The attack seems to be focused on "Transfer-Encoding: chunked" and
"Content-Length" in HTTP.

The author blames the design of HTTP/1.1:
https://news.ycombinator.com/item?id=20641061

It seems RFC 7230 already addresses this very case:
https://tools.ietf.org/html/rfc7230#section-3.3.3

"If a message is received with both a Transfer-Encoding and a
Content-Length header field, the Transfer-Encoding overrides the
Content-Length. Such a message might indicate an attempt to perform
request smuggling (Section 9.5) or response splitting (Section 9.4)
and ought to be handled as an error. A sender MUST remove the received
Content-Length field prior to forwarding such a message downstream."

Thanks