CAPEC-105 - HTTP Request Splitting

HTTP Request Splitting (also known as HTTP Request Smuggling) is an attack pattern where an attacker attempts to insert additional HTTP requests in the body of the original (enveloping) HTTP request in such a way that the browser interprets it as one request but the web server interprets it as two.

There are several ways to perform HTTP request splitting attacks. One way is to include double Content-Length headers in the request to exploit the fact that the devices parsing the request may each use a different header. Another way is to submit an HTTP request with a "Transfer Encoding: chunked" in the request header set with setRequestHeader to allow a payload in the HTTP Request that can be considered as another HTTP Request by a subsequent parsing entity. A third way is to use the "Double CR in an HTTP header" technique. There are also a few less general techniques targeting specific parsing vulnerabilities in certain web servers.

Severity

Likelihood

Confidentiality

Integrity

Availability

  • Attack Methods 3
  • Protocol Manipulation
  • Injection
  • Analysis
  • Purposes 1
  • Exploitation
  • Sec Principles 4
  • Economy of Mechanism
  • Secure the Weakest Link
  • Compartmentalization
  • Defense in Depth
  • Scopes 4
  • Execute unauthorized code or commands
  • Availability
  • Integrity
  • Confidentiality
  • Gain privileges / assume identity
  • Authorization
  • Access_Control
  • Confidentiality
  • Read application data
  • Confidentiality
  • Modify application data
  • Integrity

Medium level: Good understanding of the HTTP protocol and the parsing mechanisms employed by various web servers

User-manipulateable HTTP Request headers are processed by the web server

Low: No specialized equipment is needed

Issue HTTP Requests against a target server and examine responses.

Understand the possible underlying weaknesses in the third party technologies being used and stay up to date with the vendor patches.

Step 1 - Investigate Target Environment

Determine the technologies used in the target environment such as types of browsers, web servers, application firewalls, proxies, etc..

Tecnique ID: 1 - Environment(s) env-Web

Investigation of the target environment to determine the types of technologies used to parse the incoming HTTP requests. Attempt to understand how HTTP Request headers are parsed


Step 1 - Post a malicious HTTP Request

Post a malicious HTTP request that will be interpreted as multiple HTTP requests when parsed on the server.

Tecnique ID: 1 - Environment(s) env-Web

Post a malicious HTTP Request utilizing double CR/LF characters in HTTP header to cause request splitting

Tecnique ID: 2 - Environment(s) env-Web

Post a malicious HTTP Request utilizing "Transfer Encoding: chunked" in the request header to cause request splitting

Tecnique ID: 3 - Environment(s) env-Web

Post a malicious HTTP Request utilizing double Content-Length headers to cause request splitting


System integration testing must include security checks to protect against Multiple Interpretation Errors across systems.

Make sure to install the latest vendor security patches available for the web server.

If possible, make use of SSL.

Install a web application firewall that has been secured against HTTP Request Splitting

Use web servers that employ a tight HTTP parsing process