Détail du CWE-444

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Modes d'introduction

Implementation

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Technologies

Class: Web Based (Undetermined)
Name: Web Server (Undetermined)

Conséquences courantes

Exemples observés

Mesures d’atténuation potentielles

Phases : Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Phases : Implementation
Use only SSL communication.
Phases : Implementation
Terminate the client session after each request.
Phases : System Configuration
Turn all pages to non-cacheable.

Méthodes de détection

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Modèles d'attaque associés

Notes

Request smuggling can be performed due to a multiple interpretation error, where the target is an intermediary or monitor, via a consistency manipulation (Transfer-Encoding and Content-Length headers).

Références

REF-433

HTTP Request Smuggling
Chaim Linhart, Amit Klein, Ronen Heled, Steve Orrin.
https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf

REF-1273

HTTP Response Smuggling
Robert Auger.
http://projects.webappsec.org/w/page/13246930/HTTP%20Response%20Smuggling

REF-1274

HTTP Request Smuggling: Complete Guide to Attack Types and Prevention
Dzevad Alibegovic.
https://brightsec.com/blog/http-request-smuggling-hrs/

REF-1275

A Pentester's Guide to HTTP Request Smuggling
Busra Demir.
https://www.cobalt.io/blog/a-pentesters-guide-to-http-request-smuggling

REF-1276

HTTP Desync Attacks in the Wild and How to Defend Against Them
Edi Kogan, Daniel Kerman.
https://www.imperva.com/blog/archive/http-desync-attacks-and-defence-methods/

REF-1277

HTTP Desync Attacks: Request Smuggling Reborn
James Kettle.
https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

REF-1278

HTTP request smuggling
PortSwigger.
https://portswigger.net/web-security/request-smuggling

Soumission

Modifications