Forest Global Training Partners

Cyber Risks · PortSwigger Research

HTTP Desync Attacks: what happened next

Summary: PortSwigger researcher James Kettle reports that after publishing HTTP Desync Attacks: Request Smuggling Reborn, Akamai deployed a hotfix roughly 48 hours after his presentation so its front-end servers prioritize chunked Transfer-Encoding by default, F5 published advisory K50375550 for BIG-IP servers, HAProxy fixed a vertical tab normalization flaw in release 2.0.6, and Golang published CVE-2019-16276 for its net/http library. Kettle also devised new desync techniques, including one from Soroush Dalili's WAF-bypass research involving a superfluous carriage return that led to a $16,500 bounty, and updated HTTP Request Smuggler to v1.02 to address a false-positive rate of roughly 1% that he expects to rise as real vulnerabilities get fixed.

What's compelling: Akamai's silent fix landed within 48 hours with no public advisory, while F5, HAProxy and Golang each required separate vendor action - so the exposure window for any given organization depended on which front-end and back-end pair it happened to run.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2019-16276
Related