Skip to main content

HTTP Request Smuggling (desync shapes)

First-party proxy, forwarding or hand-rolled HTTP parsing code lets a front end and a back end disagree about where one request ends and the next begins. An attacker uses the disagreement to prepend bytes to someone else's request, leading to credential theft or cache poisoning.

What Vulkro detects​

Two deterministic shape rules over your own source. Neither is a taint proof or a live desync test.

  • SMUGGLE-001 (Medium): a reverse-proxy or forwarding path copies a client Transfer-Encoding header onto the upstream request, for example in an httputil.ReverseProxy Director or a manual passthrough loop. The message calls out the riskier case where both Transfer-Encoding and Content-Length are forwarded. A proxy that strips hop-by-hop headers never matches, and a proxy context is required, so a plain Content-Length write is not flagged.
  • SMUGGLE-002 (Medium, heuristic): a hand-rolled parser reads Content-Length off a raw connection (bufio.NewReader, ReadString, a manual header loop) and parses it with no visible guard against a duplicate or conflicting Content-Length / Transfer-Encoding. Parsers that already mention such a guard are skipped.

Vulnerable library or proxy versions are covered by the dependency scan, not this rule.

Non-compliant code​

// Go: proxy forwards the client's framing headers
proxy.Director = func(req *http.Request) {
    req.Header.Set("Transfer-Encoding", clientReq.Header.Get("Transfer-Encoding"))
    req.Header.Set("Content-Length", clientReq.Header.Get("Content-Length"))
}

Compliant code​

// Go: hop-by-hop headers dropped; net/http sets framing from req.Body
proxy.Director = func(req *http.Request) {
    req.Header.Del("Transfer-Encoding")
    req.Header.Del("Connection")
}

How to fix​

  • Strip hop-by-hop headers before forwarding and never re-send a client Transfer-Encoding.
  • Let one component own request framing.
  • In a hand-rolled parser, answer 400 to a request with more than one Content-Length, or with both Content-Length and Transfer-Encoding.

References​

See also: Confidence model.

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.

Last updated on