|
|
|
Vulnerability Note VU#625878Single crafted HTTP request may result in multiple responsesOverviewSome HTTP handling devices are vulnerable to a flaw which may allow a specially crafted request to elicit multiple responses, some of which may be controlled by the attacker. These attacks may result in cache poisoning, information leakage, cross-site scripting, and other outcomes.I. DescriptionA flaw in handling HTTP requests that contain the "HTTP Request Smuggling" class of attacksHTTP Request Smuggling attacks involve injecting HTTP request(s) within other HTTP requests. Devices that handle HTTP data, such as web caches and proxy servers, may contribute to a class of attacks known as "HTTP Request Smuggling" attacks. HTTP Request Smuggling attacks occur when specially-crafted HTTP requests are inconsistently processed by multiple interconnected devices. In this manner the secondary request(s) may be "smuggled" through other devices without detection.As a simple example, including multiple Content-Length headers into a single request may result in interconnected devices handling the request in a different manner. Given two Content-Length headers, partial request data may be processed on one device where another subsequent device (using the longer Content-Length header) may read more request data. This in turn changes the nature of the request and may result in cache poisoning or request hijacking.
References
Thanks to Watchfire for providing information on this flaw. This document was written by Ken MacInnis based primarily on information provided by Watchfire
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
|||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||
Get Adobe Reader