Live data from Hacker News

HTTP Desync Attacks: Request Smuggling Reborn

portswigger.net

11–12 of 12 posts

Re: HTTP Desync Attacks: Request Smuggling Reborn

#11
post #9

Earlier quoted context omitted.

Glad you like the research! I'll look into emphasising the vector though I'm personally coming to the viewpoint that the root cause is a design flaw in HTTP/1.1, and HTTP/2 is the only truly reliable fix.

Thanks for the comments. I don't see that using HTTP/2 is realistic. (a) Are you saying that using HTTP/2 from the browser makes headers in your infrastructure secure? (b) Some of our enterprise clients use security proxies (e.g. Cisco WSA) which do not support HTTP/2 and force connections from the browser to use HTTP1.1. Aside: Cisco WSA is super crappy: we have recorded a repeatable corruption that passed informati…

I'm suggesting using HTTP/2 between the frontend and backend. I'm saying this is the only reliable fix, not that it's easy to implement.

Regarding HTTPS between the frontend and backend, remember that's just HTTP over a TLS stream instead of TCP. As long as the frontend still reuses these TLS streams, it's exploitable. To be clear, this is in a scenario where the front-end terminates the HTTPS connection from the client then routes requests over a pool of persistent HTTPS connections to the backend. Does that make sense? Since I've been exploiting this from a black-box perspective, I can't really tell for sure whether I've successfully exploited any websites actually doing this.

And yeah it would have been nice of this had done better on HN but between presenting it at two major security conferences and adding automated detection to a popular web scanner, it ought to achieve decent awareness over the next few months. Hopefully.

Re: HTTP Desync Attacks: Request Smuggling Reborn

#12
post #10

I've been waiting to hear more about this since the abstract was published. What was the timelines involved here? PayPal, Trello, and others were contacted over the course of this investigation. It would be nice to know what their response times were to such a serious vulnerability.

You can now see the PayPal timelines here: https://hackerone.com/reports/488147 https://hackerone.com/reports/510152

Trello patched it in roughly 10 days. In general I found companies took longer to patch this issue than other similar-severity vulnerabilities, probably because it's conceptually unfamiliar so I frequently had to spend quite a while explaining it, and the patch itself appears to be challenging sometimes too.

Post reply on HN