Lab: Client-side desync
Summary: PortSwigger Research published a lab showing client-side desync attacks, where a server ignores the Content-Length header on requests to some endpoints, letting an attacker induce a victim's browser to disclose its session cookie. The lab walks through identifying the desync vector in Burp, confirming it in a browser via fetch() with an intentional CORS error, and using a comment function as a gadget to capture the victim's request and steal the cookie. The lab is based on real-world vulnerabilities discovered by PortSwigger Research and is a client-side variation of a prior request smuggling technique.
What you should know: The attack runs from the victim's own browser, so the requests that leak the session cookie originate from a trusted client rather than an external host. A server that ignores Content-Length on even a few endpoints is enough to turn a stored comment field into a cookie-exfiltration channel.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026