HTTP Request Smuggling

CriticalWeb Application SecurityA03:2021 – Injection

Discrepancies in how front-end proxies and back-end servers parse HTTP requests allow attackers to smuggle a hidden request inside another, enabling cache poisoning, session hijacking, WAF bypass, and access to other users' responses.

Immediate Response

1Disable HTTP/1.1 connection reuse (keep-alive) between front-end and back-end servers.
2Configure front-end and back-end to reject ambiguous requests with conflicting headers.
3Purge any poisoned cache entries and invalidate affected sessions.
4Deploy WAF rules to block requests with duplicate Content-Length or Transfer-Encoding headers.

All playbooks

1Use HTTP/2 end-to-end between front-end and back-end to eliminate CL/TE parsing discrepancies.
2Configure all proxies and servers to reject requests with ambiguous or duplicate headers.
3Normalize request parsing behavior across all layers of the application stack.
4Implement request validation middleware that rejects smuggling patterns.

Long-term Prevention

1Include HTTP request smuggling tests in regular penetration testing engagements.
2Use automated tools to test for desync vulnerabilities across all proxy and server combinations.
3Adopt HTTP/2 or HTTP/3 end-to-end to reduce parsing ambiguity attack surface.
4Monitor for anomalous request patterns indicative of smuggling reconnaissance.

Attack vectors

CL.TE desync: front-end uses Content-Length while back-end uses Transfer-Encoding
TE.CL desync: front-end uses Transfer-Encoding while back-end uses Content-Length
TE.TE desync: both use Transfer-Encoding but parse obfuscated headers differently
HTTP/2 downgrade attacks exploiting header parsing differences between protocol versions

Indicators of compromise

Users receiving responses intended for other users or seeing injected content
Unexpected 403 or 502 errors following crafted request sequences
WAF or proxy logs showing requests with duplicate or conflicting Content-Length and Transfer-Encoding headers
Cache entries containing responses from smuggled requests

Tooling

Burp Suite (HTTP Request Smuggler extension)SmugglerTurbo IntruderHTTPwookie