HTTP Request Smuggling in 2020 – New Variants, New Defenses and New Challenges

The presentation discusses HTTP request smuggling and its potential impact on web security. The speaker proposes solutions to protect against this type of attack.

• HTTP request smuggling can lead to web cache poisoning and other security vulnerabilities
• Normalization of outbound HTTP headers is not an effective solution for protection
• Mod Security Plus CRS can be used as a web application firewall against HTTP request smuggling
• HTTP request smuggling can be used to manipulate cached content and cause damage to companies
• The speaker's proposed solutions focus on specific protection against HTTP request smuggling rather than catch-all solutions

The speaker provides examples of successful HTTP request smuggling attacks against common off-the-shelf software, including the Squid proxy and Abyss X1 server. The speaker also discusses how HTTP request smuggling can be used to manipulate cached content and cause damage to companies by replacing cached content with false information.

HTTP Request Smuggling (AKA HTTP Desyncing) is an attack technique invented in 2005 that exploits different interpretations of a stream non-standard HTTP requests among various HTTP devices between the client (attacker) and the server (including the server itself). It can be used to smuggle requests across WAFs and security solutions, poison HTTP caches, inject responses to users and hijack user requests.You'd think that HTTP Request Smuggling should be difficult to find in 2020. After all, protecting against HTTP Request Smuggling is all about having an HTTP parser adhering to the RFC standards. And with James Kettle's presentation in Black Hat 2019 which put the issue back in the limelight, awareness must be high these days. Even more so with COTS software which can easily be reviewed and patched by its vendor. Not so. In this presentation, I demonstrate four new HTTP Request Smuggling attack variants that work against COTS, popular, present-day web servers and HTTP proxy servers. I also describe a successful attack with an old variant, and I demonstrate a circumvention of an existing HTTP Request Smuggling protection for a free, open source application security solution.I then discuss the shortcomings of existing free, open source solutions for HTTP Request Smuggling, and describe and share my C++ "Request Smuggling Firewall" class library that can be injected to any user-space process (web server or proxy server) to provide robust socket-level protection against HTTP Request Smuggling. My class library is extensible beyond HTTP Request Smuggling, and in fact beyond HTTP.Finally, I describe some anomalies I found in various web servers and proxy servers, and challenge the security research community to find a "matching" software to make them into full HTTP Request Smuggling attacks.