HTTP Smuggling
CriticalHTTP Request Smuggling
Definition
HTTP Request Smuggling is a vulnerability that abuses discrepancies in how front-end servers (proxies, load balancers) and back-end servers interpret the boundaries between HTTP requests. The attacker sends ambiguous requests that are processed differently, allowing them to 'smuggle' one request inside another.
Impact
Bypassing front-end security controls (WAF, authentication)Web cache poisoningCapturing other users' requests (credential theft)Redirecting requests to other usersRunning XSS attacks without user interaction
Examples
HTTP Smuggling CL.TE
In a CL.TE attack, the front-end uses Content-Length and forwards 13 bytes. The back-end uses Transfer-Encoding: chunked, reads the '0' chunk (end of body) and treats 'SMUGGLED' as the start of the next request, which will be processed as if it came from another user.
POST / HTTP/1.1 Host: victim.com Content-Length: 13 Transfer-Encoding: chunked 0 SMUGGLED