CAPEC-33 HTTP Request Smuggling

An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server). See CanPrecede relationships for possible consequences.

A maliciously crafted HTTP request, which contains a second secretly embedded HTTP request is interpreted by an intermediary web proxy as single benign HTTP request, is forwarded to a back-end server, that interprets and parses the HTTP request as two authorized benign HTTP requests bypassing security controls. This attack usually involves the misuse of the HTTP headers: Content-Length and Transfer-Encoding. These abuses are discussed in RFC 2616 #4.4.3 and section #4.2 and are related to ordering and precedence of these headers. [REF-38] Additionally this attack can be performed through modification and/or fuzzing of parameters composing the request-line of HTTP messages. This attack is usually the result of the usage of outdated or incompatible HTTP protocol versions in the HTTP agents. This differs from CAPEC-273 HTTP Response Smuggling, which is usually an attempt to compromise a client agent (e.g., web browser) by sending malicious content in HTTP responses from back-end HTTP infrastructure. HTTP Request Smuggling is an attempt to compromise aback-end HTTP agentvia HTTP Request messages. HTTP Splitting (CAPEC-105 and CAPEC-34) is different from HTTP Smuggling due to the fact that during implementation of asynchronous requests, HTTP Splitting requires the embedding/injection of arbitrary HTML headers and content through user input into browser cookies or Ajax web/browser object parameters like XMLHttpRequest.

1. [Explore] [Survey network to identify target] The adversary performs network reconnaissance by monitoring relevant traffic to identify the network path and parsing of the HTTP messages with the goal of identifying potential targets. 1. [Experiment] [Identify vulnerabilities in targeted HTTP infrastructure and technologies] The adversary sends a variety of benign/ambiguous HTTP requests to observe responses from HTTP infrastructure in order to identify differences/discrepancies in the interpretation and parsing of HTTP requests by examining supported HTTP protocol versions, message sizes, and HTTP headers. 2. [Experiment] [Cause differential HTTP responses by experimenting with identified HTTP Request vulnerabilities] The adversary sends maliciously crafted HTTP requests to interfere with the parsing of intermediary and back-end HTTP infrastructure, followed by normal/benign HTTP request from the adversary or a random user. The intended consequences of the malicious HTTP requests will be observed in the HTTP infrastructure response to the normal/benign HTTP request to confirm applicability of identified vulnerabilities in the adversary's plan of attack. 1. [Exploit] [Perform HTTP Request Smuggling attack] Using knowledge discovered in the experiment section above, smuggle a message to cause one of the consequences.

• An additional intermediary HTTP agent such as an application firewall or a web caching proxy between the adversary and the second agent such as a web server, that sends multiple HTTP messages over same network connection. • Differences in the way the two HTTP agents parse and interpret HTTP requests and its headers. • HTTP agents running on HTTP/1.1 that allow for Keep Alive mode, Pipelined queries, and Chunked queries and responses.

• [Medium] Detailed knowledge on HTTP protocol: request and response messages structure and usage of specific headers. • [Medium] Detailed knowledge on how specific HTTP agents receive, send, process, interpret, and parse a variety of HTTP messages and headers. • [Medium] Possess knowledge on the exact details in the discrepancies between several targeted HTTP agents in path of an HTTP message in parsing its message structure and individual headers.

• Confidentiality, Integrity, Availability: Execute Unauthorized Commands • Confidentiality, Access Control, Authorization: Gain Privileges • Integrity: Modify Data

• Design: evaluate HTTP agents prior to deployment for parsing/interpretation discrepancies. • Configuration: front-end HTTP agents notice ambiguous requests. • Configuration: back-end HTTP agents reject ambiguous requests and close the network connection. • Configuration: Disable reuse of back-end connections. • Configuration: Use HTTP/2 for back-end connections. • Configuration: Use the same web server software for front-end and back-end server. • Implementation: Utilize a Web Application Firewall (WAF) that has built-in mitigation to detect abnormal requests/responses. • Configuration: Prioritize Transfer-Encoding header over Content-Length, whenever an HTTP message contains both. • Configuration: Disallow HTTP messages with both Transfer-Encoding and Content-Length or Double Content-Length Headers. • Configuration: Disallow Malformed/Invalid Transfer-Encoding Headers used in obfuscation, such as: • Headers with no space before the value “chunked” • Headers with extra spaces • Headers beginning with trailing characters • Headers providing a value “chunk” instead of “chunked” (the server normalizes this as chunked encoding) • Headers with multiple spaces before the value “chunked” • Headers with quoted values (whether single or double quotations) • Headers with CRLF characters before the value “chunked” • Values with invalid characters • Configuration: Install latest vendor security patches available for both intermediary and back-end HTTP infrastructure (i.e. proxies and web servers) • Configuration: Ensure that HTTP infrastructure in the chain or network path utilize a strict uniform parsing process. • Implementation: Utilize intermediary HTTP infrastructure capable of filtering and/or sanitizing user-input.