HTTP Desync Attacks, also known as HTTP request smuggling, exploit inconsistencies in the interpretation of HTTP headers by different servers in a chain, such as between a front-end server (e.g., load balancer, caching server) and a back-end server (e.g., application server).
These attacks can disrupt how HTTP requests are processed, allowing an attacker to inject malicious requests, manipulate server responses, or perform other harmful actions.
How do HTTP Desync Attacks Arise?
HTTP Desync Attacks arise due to inconsistencies in parsing HTTP headers, primarily the Content-Length and Transfer-Encoding headers, which indicate the length of the HTTP message body. When servers interpret these headers differently, an attacker can craft an HTTP request in such a way that one server processes it correctly, while another processes it incorrectly. This desynchronization creates an opportunity to “smuggle” malicious requests through intermediary servers.
The primary conditions that lead to HTTP desync attacks include:
- Mismatched HTTP header parsing: Variations in how servers interpret conflicting Content-Length and Transfer-Encoding headers.
- Proxy server configurations: Incorrectly configured proxy servers can amplify these parsing inconsistencies.
- Pipelined requests: Servers that allow HTTP pipelining without proper validation can be vulnerable.
Impact of HTTP Desync Attacks :
- Session hijacking: An attacker can inject malicious content into another user’s session.
- Cross-Site Scripting (XSS): Inserting malicious scripts into a response that is sent to another user.
- Web cache poisoning: An attacker can store malicious content in a web cache, which can then be served to users.
- Sensitive information disclosure: Manipulating server responses to leak sensitive information.
- Denial of Service (DoS): Flooding the server with malformed requests, causing server disruption.
Mitigations of HTTP Desync Attacks :
- Consistent Parsing: Ensure that all servers in the chain (load balancers, proxies, application servers) have consistent HTTP parsing behavior.
- Disable HTTP/1.1 Pipelining: If not needed, disable HTTP/1.1 request pipelining to prevent potential request desynchronization.
- Sanitize HTTP Headers: Remove or normalize conflicting HTTP headers (Content-Length and Transfer-Encoding) to avoid discrepancies between server interpretations.
- Update and Patch: Keep web servers, proxies, and load balancers up to date with the latest security patches that address known HTTP desynchronization vulnerabilities.
- Implement Robust Security Testing: Use automated security tools (e.g., Burp Suite’s HTTP Request Smuggler) to detect desync vulnerabilities during penetration testing.
- Web Application Firewall (WAF): Deploy a WAF to detect and block suspicious HTTP traffic patterns that may indicate desync attempts.
- Strict Content-Length Validation: Servers should strictly adhere to Content-Length header validation to prevent conflicting or ambiguous HTTP message bodies.
