HTTP Request Smuggling: Definition, Examples, and Prevention
Risk Factors
Likelihood
Complexity
Business Impact
What Is HTTP Request Smuggling?
Websites often rely on load balancers, content delivery networks (CDNs), or reverse proxies to manage incoming HTTP requests over a single connection. HTTP request smuggling is a web application attack that takes advantage of inconsistencies in how front-end servers (proxies) and back-end servers process requests from more than one sender.
This can enable an attacker to bypass security controls and gain access to a site administration page, or open doors for other attack techniques such as cross-site scripting (XSS). HTTP request smuggling is sometimes referred to as HTTP desynchronization.
Here's a simple overview of how the attack works: When a server processes an HTTP request, the server determines the length (beginning and end) of the HTTP content by referring to the Content-Length or Transfer-Encoding headers. If both of these headers are present in the same request, they might provide conflicting information. To prevent a conflict, a server will ignore one of the headers.
However, a front-end proxy server might ignore a different header than a back-end server. HTTP request smuggling attacks include both headers in a request, followed by more inbound HTTP requests that are chained together in one HTTP connection. This causes a problem in how front-end and back-end servers determine the beginning and end of each request in the chain. The end of a malicious HTTP request is miscalculated, leaving malicious content unprocessed by one server and then added to the beginning of the next inbound request in the chain.
Protection Against HTTP Request Smuggling
Certain IT optimizations can leave systems vulnerable to HTTP smuggling, such as the reuse of back-end server connections. Disabling reuse forces each request to be sent over a separate connection, reducing risk of HTTP desynchronization. Using HTTP/2 on back-end servers may also help mitigate unauthorized requests, as the protocol helps prevent ambiguity. Finally, many web application firewalls may help identify and block inconsistencies in HTTP request traffic, mitigating any potentially smuggled requests. Unfortunately, firewalls may also serve as a mechanism for smuggling.
Detection of HTTP request smuggling attacks can be enhanced using decryption. HTTP request smuggling attacks typically occur against public facing services via HTTPs. For this reason, it's critical that security tools have decryption capabilities for all commonly encrypted industry protocols such as TLS.