Lab: HTTP/2 request splitting via CRLF injection
Summary: PortSwigger's lab demonstrates HTTP/2 request splitting via CRLF injection, where a front-end server downgrades HTTP/2 requests and fails to adequately sanitize incoming headers, leaving it vulnerable to request smuggling. The exercise uses response queue poisoning to capture an admin's post-login session cookie and reach the /admin panel, where the admin user logs in approximately every 10 seconds and the back-end connection resets every 10 requests.
Key Takeaway: A front-end that downgrades HTTP/2 without sanitizing headers lets an attacker poison the response queue and capture another user's session cookie - here the admin's 302 response - turning a protocol translation step into a path to the admin panel.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026