Understanding HTTP Request Smuggling: Types, Examples, and Prevention

HTTP Request Smuggling is a complex web application attack technique that exploits inconsistencies in the way a website processes sequences of HTTP requests. It can lead to various security issues, including web cache poisoning, bypassing security controls, and cross-site scripting (XSS). Let’s explore its types, examples, and how to prevent them.

Types of HTTP Request Smuggling:

1. CL-TE (Content-Length & Transfer-Encoding) Smuggling:
   • This occurs when one server uses the Content-Length header and another server uses the Transfer-Encoding: chunked header to determine the end of a request.
2. TE-CL Smuggling:
   • The opposite of CL-TE, where one server uses the Transfer-Encoding header, and another server uses the Content-Length header.

Examples of Vulnerable Requests and Responses:

1. CL-TE Smuggling Example:
   • Request:

POST / HTTP/1.1
Host: vulnerable-website.com
Content-Length: 13
Transfer-Encoding: chunked

0

GPOST / HTTP/1.1
Host: vulnerable-website.com
Content-Length: 6

foo

Server Response:

HTTP/1.1 200 OK
...

• Explanation: The server that prioritizes Content-Length processes the request according to the Content-Length header, treating the rest of the data as a new request.

TE-CL Smuggling Example:

• Request:

POST / HTTP/1.1
Host: vulnerable-website.com
Transfer-Encoding: chunked
Content-Length: 6

5
GPOST
0

Server Response:

HTTP/1.1 200 OK
...

Explanation: The server that prioritizes Content-Length processes the request according to the Content-Length header, treating the rest of the data as a new request.

Prevention Methods:

1. Consistent Parsing:
   • Ensure all intermediary and backend systems (like caches, firewalls, and web servers) parse HTTP requests consistently.
2. Input Validation:
   • Implement strict input validation to reject ambiguous requests with multiple content-length headers or conflicting transfer-encoding and content-length headers.
3. Regular Updates and Testing:
   • Keep all web servers, proxies, and other network components updated. Regularly test for smuggling vulnerabilities.
4. Web Application Firewalls (WAF):
   • Deploy a WAF that can recognize and block smuggling attempts.
5. Unified Processing:
   • Avoid using multiple, disparate systems to process parts of HTTP requests. A unified approach reduces discrepancies in request processing.