HTTP Request Smuggling

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries. When a reverse proxy or load balancer forwards requests to a back-end server, both must agree on where one request ends and the next begins. This boundary is defined by either Content-Length (specifying exact body bytes) or Transfer-Encoding: chunked (indicating variable-length chunks). When servers interpret these headers differently, an attacker can craft a malicious request that appears as one request to the front-end but becomes two requests to the back-end.

The classic CL.TE variant works when the front-end prioritizes Content-Length while the back-end honors Transfer-Encoding. An attacker sends a request with both headers where the Content-Length value is smaller than the actual body. The front-end forwards the entire request, believing it ends earlier than it actually does. The back-end processes the declared content length as one request, then interprets the remaining bytes as the start of a new request—which gets prepended to the next legitimate user's request that arrives.

The TE.CL variant reverses this: the front-end reads chunked encoding while the back-end uses Content-Length. TE.TE attacks exploit even subtler differences—both servers support chunked encoding, but one can be tricked through obfuscation like extra spaces, mixed-case headers, or duplicate Transfer-Encoding directives. The attacker's smuggled request fragment poisons the request stream, affecting whatever user request follows.

• Authentication bypass — smuggled requests inherit the authenticated session of the subsequent victim request
• Request hijacking — capture sensitive data (credentials, tokens, API keys) from other users' requests by smuggling a prefix that logs or reflects their data
• Web cache poisoning — inject malicious content that gets cached and served to all users accessing that resource
• Cross-site scripting — smuggle requests that inject JavaScript payloads into responses served to other users
• Access control circumvention — route requests to restricted endpoints by bypassing front-end security filters

Security researchers discovered request smuggling vulnerabilities in major CDN providers and reverse proxies throughout 2019-2020, affecting services that process billions of requests daily. Attackers successfully bypassed WAF protections by smuggling malicious payloads that the security layer never inspected, since the WAF and back-end disagreed on request boundaries.

E-commerce platforms running vulnerable configurations experienced account takeover attacks where smuggled requests captured session tokens from subsequent legitimate user requests, granting attackers full account access without credential theft.

Content delivery networks suffered cache poisoning incidents where attackers smuggled requests causing the CDN to cache malicious JavaScript, which was then served to thousands of users requesting the same resource.

• Deploy HTTP/2 end-to-end — eliminates ambiguity since HTTP/2 uses binary framing with explicit length prefixes
• Reject ambiguous requests — drop any request containing both Content-Length and Transfer-Encoding headers
• Normalize forwarded requests — ensure the front-end rewrites requests to use only one length mechanism before forwarding
• Disable back-end connection reuse — configure each back-end request to use a fresh connection (reduces performance but prevents smuggling)
• Use identical HTTP parsing — deploy the same server software for both front-end and back-end tiers