Attacking Websites: Detecting and Preventing HTTP Request Smuggling Attacks

Abstract

Until the development of HTTP request smuggling in 2005, individual HTTP requests were considered as independent entities and could not be split or merged. This is a security problem caused by inconsistent content length interpretation approach between web servers, or the web server is not fully implemented in accordance with the RFC standard. It is especially dangerous for web services with complex web architectures. It can route the victims to receive malicious responses, amplify the impact of certain low-threat vulnerabilities, steal user credentials, or bypass network devices’ defenses. However, since its concept and implementation are quite difficult to overcome, it is often ignored by many network administrators, making users who browse such websites vulnerable to the HTTP request smuggling attacks. This paper proposes a general solution to deal with various HTTP request smuggling attacks. A reverse proxy implemented by Flask validates and cleans dubious HTTP requests from the client side and ensures that the original requests comply with RFC standards. Therefore, the website administrators no longer need to configure complicated network settings or customize some open-source project codes to resist or minimize the risk of the HTTP request smuggling attacks. A series of experiments demonstrate that this method is effective and practical.

Exploration of browser-powered desync attacks via HTTP/3

“…A research article titled "Attacking Websites: Detecting and Preventing HTTP Request Smuggling Attacks " explained that inconsistent content length interpretation between web servers is specifically dangerous for web services with complex web architectures. It can route the victims to receive malicious responses, steal user credentials, or bypass network devices' defenses [25].…”