Lab: Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability

Summary: PortSwigger's lab sets up a front-end and back-end server where the back-end does not support chunked encoding, and an admin panel at /admin is blocked by the front-end. The intended solution requires HTTP/1-only techniques to smuggle a request past the front-end that reaches the admin panel and deletes the user carlos.
Why it matters: The front-end control here is only as good as the two servers' agreement on where a request ends - a mismatch in chunked encoding handling lets an attacker reach an admin panel the front-end was specifically configured to block.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026