Chi tiết CWE-444

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Các cách xuất hiện

Implementation

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Công nghệ

Lớp: Web Based (Undetermined)
Tên: Web Server (Undetermined)

Hậu quả phổ biến

Ví dụ đã quan sát

Các biện pháp giảm thiểu tiềm năng

Phases : Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Phases : Implementation
Use only SSL communication.
Phases : Implementation
Terminate the client session after each request.
Phases : System Configuration
Turn all pages to non-cacheable.

Phương pháp phát hiện

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Mẫu tấn công liên quan

Ghi chú

Request smuggling can be performed due to a multiple interpretation error, where the target is an intermediary or monitor, via a consistency manipulation (Transfer-Encoding and Content-Length headers).

Tài liệu tham khảo

REF-433

HTTP Request Smuggling
Chaim Linhart, Amit Klein, Ronen Heled, Steve Orrin.
https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf

REF-1273

HTTP Response Smuggling
Robert Auger.
http://projects.webappsec.org/w/page/13246930/HTTP%20Response%20Smuggling

REF-1274

HTTP Request Smuggling: Complete Guide to Attack Types and Prevention
Dzevad Alibegovic.
https://brightsec.com/blog/http-request-smuggling-hrs/

REF-1275

A Pentester's Guide to HTTP Request Smuggling
Busra Demir.
https://www.cobalt.io/blog/a-pentesters-guide-to-http-request-smuggling

REF-1276

HTTP Desync Attacks in the Wild and How to Defend Against Them
Edi Kogan, Daniel Kerman.
https://www.imperva.com/blog/archive/http-desync-attacks-and-defence-methods/

REF-1277

HTTP Desync Attacks: Request Smuggling Reborn
James Kettle.
https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

REF-1278

HTTP request smuggling
PortSwigger.
https://portswigger.net/web-security/request-smuggling

Gửi

Sửa đổi