Lab: Response queue poisoning via H2.TE request smuggling
Summary: PortSwigger's lab demonstrates response queue poisoning through H2.TE request smuggling, exploiting a front-end server that downgrades HTTP/2 requests even when they carry an ambiguous length. The exercise walks through smuggling a prefix via chunked encoding, poisoning the response queue to capture an admin's 302 response and session cookie, then using that cookie to reach /admin and delete the user carlos.
Key Takeaway: The lab notes an admin logs in roughly every 15 seconds and the back-end connection resets every 10 requests, so a captured session cookie is a matter of persistence rather than luck. A front-end that downgrades HTTP/2 without resolving ambiguous lengths hands an attacker other users' responses, including their authenticated sessions.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026