albinowax - HTTP Desync Attacks: Smashing into the Cell Next Door

HTTP Desync Attacks

James Kettle (albinowax), Director of Research at PortSwigger Web Security, presents HTTP request smuggling (desync attacks) — a rediscovered attack class with devastating impact on modern web infrastructure.

The Desync Primitive

HTTP/1.1 allows two mechanisms to delimit request bodies: Content-Length and Transfer-Encoding. When a frontend proxy and backend server disagree on which header takes precedence, an attacker can 'smuggle' a partial HTTP request that poisons the backend's request queue.

Attack Scenarios

Kettle demonstrates: bypassing WAFs and access controls by wrapping the prohibited request inside an innocuous smuggled prefix; hijacking other users' sessions by capturing their request data; and poisoning the shared reverse proxy cache to serve malicious responses to arbitrary users.

Real-World Impact

Findings affect major CDN providers and web frameworks. Kettle provides detection methodologies and recommends disabling HTTP/1.1 Keep-Alive on internal proxy-to-backend hops where possible.