Lab: Bypassing access controls via HTTP/2 request tunnelling

Summary: PortSwigger's lab demonstrates request tunnelling against a front-end server that downgrades HTTP/2 requests and fails to sanitize incoming header names, allowing CRLF injection through a header name. Because the front-end does not reuse back-end connections, classic request smuggling does not apply, but the researcher smuggles a Content-Length header and a HEAD request for /admin, leaks the front-end's client authentication headers, and uses them to reach /admin/delete?username=carlos.
Why it matters: The attack works by leaking the client authentication headers the front-end appends to every request, so the trust a back-end places in those headers is only as strong as the front-end's header-name handling. An HTTP/2-to-HTTP/1.1 downgrade path that does not sanitize header names can hand an attacker the credentials needed to reach the admin panel.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026