CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Weakness ID: 444 (Weakness Base)
Status: Incomplete
Description
Description Summary
When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being aware of it.
Web servers allow request smuggling via
inconsistent Transfer-Encoding and Content-Length
headers.
Potential Mitigations
Use a web server that employs a strict HTTP parsing procedure, such as
Apache (See paper in reference).
Use only SSL communication.
Terminate the client session after each request.
Turn all pages to non-cacheable.
Other Notes
Request smuggling can be performed due to a multiple interpretation error,
where the target is an intermediary or monitor, via a consistency
manipulation (Transfer-Encoding and Content-Length headers).
Description
