Lab: HTTP/2 request smuggling via CRLF injection
Summary: PortSwigger's lab demonstrates HTTP/2 request smuggling against a front-end server that downgrades HTTP/2 requests and fails to sanitize incoming headers, letting an attacker inject CRLF sequences into a header value followed by a Transfer-Encoding: chunked header. The smuggled prefix causes the back-end to append the victim's subsequent request, and since the victim loads the home page every 15 seconds, the attacker can capture the start of that request, including the victim's session cookie, and reuse it to access the account.
Bottom line: The attack needs no exploit against the victim at all: a front-end that downgrades HTTP/2 without properly sanitizing headers lets an attacker harvest session cookies from ordinary page loads, so the question is whether your edge tier treats header values as untrusted input before they reach the back-end.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026