Vulnerabilities
HTTP Request Smuggling
Also known as: HRS, Request smuggling
Definition
An attack that exploits disagreements between a front-end proxy and a back-end server on how an HTTP request ends, so an attacker can sneak a hidden second request through.
Examples
- CL.TE smuggling against a CDN/back-end pair where the CDN uses Content-Length and the origin uses Transfer-Encoding.
- Smuggled POST request stealing the next user's Authorization header from a shared keep-alive connection.
Related terms
HTTP Response Splitting
An injection vulnerability where untrusted CR/LF characters in user input force the server to emit additional, attacker-controlled HTTP responses.
HTTP Desync Attack
A modern form of HTTP request smuggling that desynchronises a chain of proxies and servers to inject malicious traffic into other users' connections.
Cache Poisoning
An attack that stores a malicious response in a shared cache so that other users later receive the attacker's content.
Web Cache Deception
An attack where a malicious URL tricks an intermediary cache into storing a victim's authenticated, sensitive response under a publicly cacheable path.
Reverse Proxy
Reverse Proxy — definition coming soon.