Making desync attacks easy with TRACE
Summary: PortSwigger researcher @PortSwiggerRes describes a technique that combines HTTP/2 desync (request smuggling) with the TRACE method, which reflects the received request in the response body, to build a malicious JavaScript payload and place it in the body of a smuggled HEAD response. The article notes that Apache and many Microsoft IIS and Tomcat versions respond to TRACE by default, that proxies blocking TRACE can be bypassed through smuggling, and that the resulting response can be stored via Web Cache Poisoning to serve the payload to other users.
What's compelling: The attack needs only a backend that answers TRACE - default behavior on Apache and many IIS and Tomcat versions - and the researcher used it to turn a smuggling report the bug bounty program said was 'not a vulnerability in itself' into browser takeover via cached responses.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026