1067
Observed Examples
Reference Description
CVE-1999-0017 FTP bounce attack. The design of the protocol allows an attacker to modify
the PORT command to cause the FTP server to connect to other machines
besides the attacker's.
https://www.cve.org/CVERecord?id=CVE-1999-0017
CVE-1999-0168 RPC portmapper could redirect service requests from an attacker to another
entity, which thinks the requests came from the portmapper.
https://www.cve.org/CVERecord?id=CVE-1999-0168
CVE-2005-0315 FTP server does not ensure that the IP address in a PORT command is the
same as the FTP user's session, allowing port scanning by proxy.
https://www.cve.org/CVERecord?id=CVE-2005-0315
CVE-2002-1484 Web server allows attackers to request a URL from another server, including
other ports, which allows proxied scanning.
https://www.cve.org/CVERecord?id=CVE-2002-1484
CVE-2004-2061 CGI script accepts and retrieves incoming URLs.
https://www.cve.org/CVERecord?id=CVE-2004-2061
CVE-2001-1484 Bounce attack allows access to TFTP from trusted side.
https://www.cve.org/CVERecord?id=CVE-2001-1484
CVE-2010-1637 Web-based mail program allows internal network scanning using a modified
POP3 port number.
https://www.cve.org/CVERecord?id=CVE-2010-1637
CVE-2009-0037 URL-downloading library automatically follows redirects to file:// and scp://
URLs
https://www.cve.org/CVERecord?id=CVE-2009-0037
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 956 SFP Secondary Cluster: Channel Attack 888 2397
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Relationship
This weakness has a chaining relationship with CWE-668 (Exposure of Resource to Wrong
Sphere) because the proxy effectively provides the attacker with access to the target's resources
that the attacker cannot directly obtain.
Maintenance
This could possibly be considered as an emergent resource.
Theoretical
It could be argued that the "confused deputy" is a fundamental aspect of most vulnerabilities that
require an active attacker. Even for common implementation issues such as buffer overflows,
SQL injection, OS command injection, and path traversal, the vulnerable program already has
the authorization to run code or access files. The vulnerability arises when the attacker causes
the program to run unexpected code or access unexpected files.
Taxonomy Mappings
CWE Version 4.14
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-444: Inconsistent Interpretation of HTTP
Requests ('HTTP Request/Response Smuggling') 1068
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unintended proxy/intermediary
PLOVER Proxied Trusted Channel
WASC 32 Routing Detour
Related Attack Patterns
CAPEC-ID Attack Pattern Name
219 XML Routing Detour Attacks
465 Transparent Proxy Abuse
References
[REF-432]Norm Hardy. "The Confused Deputy (or why capabilities might have been invented)".
1988. < http://www.cap-lore.com/CapTheory/ConfusedDeputy.html >.
[REF-1125]moparisthebest. "Validation Vulnerabilities". 2015 June 5. < https://mailarchive.ietf.org/
arch/msg/acme/s6Q5PdJP48LEUwgzrVuw_XPKCsM/ >.
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/
Response Smuggling')
Weakness ID : 444
Structure : Simple
Abstraction : Base
Description
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow
between two entities such as a client and server, but it does not interpret malformed HTTP
requests or responses in ways that are consistent with how the messages will be processed by
those entities that are at the ultimate destination.
Extended Description
HTTP requests or responses ("messages") can be malformed or unexpected in ways that cause
web servers or clients to interpret the messages in different ways than intermediary HTTP agents
such as load balancers, reverse proxies, web caching proxies, application firewalls, etc. For
example, an adversary may be able to add duplicate or different header fields that a client or
server might interpret as one set of messages, whereas the intermediary might interpret the same
sequence of bytes as a different set of messages. For example, discrepancies can arise in how
to handle duplicate headers like two Transfer-encoding (TE) or two Content-length (CL), or the
malicious HTTP message will have different headers for TE and CL.
The inconsistent parsing and interpretation of messages can allow the adversary to "smuggle" a
message to the client/server without the intermediary being aware of it.
This weakness is usually the result of the usage of outdated or incompatible HTTP protocol
versions in the HTTP agents.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 436 Interpretation Conflict 1057
CWE Version 4.14
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-444: Inconsistent Interpretation of HTTP
Requests ('HTTP Request/Response Smuggling')