1 of 40

T-Reqs: �HTTP Request Smuggling �with Differential Fuzzing

Bahruz Jabiyev¹, Steven Sprecher¹, Kaan Onarlioglu², Engin Kirda¹

(¹Northeastern University, ²Akamai Technologies)

2 of 40

HTTP protocol

funny cats

POST /search HTTP/1.1

Host: google.com

Content-Length: 16

query=funny+cats

POST /search HTTP/1.1

Host: google.com

Transfer-Encoding: chunked

6

query=

A

funny+cats

0

X-Header: Value

;foo=bar

3 of 40

HTTP Request Smuggling (HRS)

POST /search HTTP/1.1

Host: google.com

Transfer-Encoding: chunked

6

query=

A ;foo=bar

funny+cats

0

X-Header: Value

POST /search HTTP/1.1

Host: google.com

Content-Length: 16

query=funny+cats

4 of 40

HTTP Request Smuggling (HRS)

POST /search HTTP/1.1

Host: google.com

Transfer-Encoding: chunked

6

query=

A ;foo=bar

funny+cats

0

X-Header: Value

Origin

Reverse Proxy

5 of 40

HTTP Request Smuggling (HRS)

POST /search HTTP/1.1

Host: google.com

Transfer-Encoding: chunked

Content-Length: 64

6

query=

A ;foo=bar

funny+cats

0

X-Header: Value�AAAAAAAAAA

;

Origin

Reverse Proxy

6 of 40

HTTP Request Smuggling (HRS)

POST /search HTTP/1.1

Host: google.com

Transfer-Encoding:;chunked

Content-Length: 64

6

query=

A ;foo=bar

funny+cats

0

X-Header: Value�AAAAAAAAAA

Origin

Reverse Proxy

AAAAAAAAAA

7 of 40

HTTP Request Smuggling (HRS)

GET /blog HTTP/1.1

Host: google.com

AAAAAAAAAA

8 of 40

HTTP Request Smuggling (HRS)

GET /blog HTTP/1.1

Host: google.com

GET /js HTTP/1.1

GET /abc HTTP/1.1

Host: google.com�

X:X

9 of 40

Attacks

Response Queue Poisoning

10 of 40

Attacks

Response Queue Poisoning
Web Cache Poisoning

11 of 40

Attacks

Response Queue Poisoning
Web Cache Poisoning
Bypassing Security Controls
Paypal and Slack cases

12 of 40

Summary 1: Discrepancies in body parsing behavior of servers can be used for HRS, which in turn can pave the way for several attacks.

13 of 40

Research Questions

Can we systematically test for HRS at scale?
What technology stacks are at risk?
What parts of a request can induce body parsing discrepancies?
What escalates a body parsing discrepancy to HRS?

14 of 40

T-Reqs Fuzzer

Generating Inputs

POST /abcdef HTTP/1.1

<METHOD> : [GET, POST, TRACE]

<URI> : [/abc, http://a.bc/]

<PROTO> : [HTTP]

<VER> : [0.9, 1.0, 1.1]

Host: example.com

Content-Length: 13

query=bananas

TRACE /abc HTTP/1.0

15 of 40

T-Reqs Fuzzer

Generating Inputs
Mutating Inputs

String mutations

Host: example.com

Content-Length: 13

query=bananas

TRACE /abc HTTP/1.0

TR/ACE /abc HTTP/1.0

TR/ACE /a?c HTTP/1.0

TR/ACE /a?c HTTP/10

16 of 40

T-Reqs Fuzzer

Generating Inputs
Mutating Inputs

String mutations
Tree mutations

Host: example.com

Content-Length: 13

query=bananas

TR/ACE /a?c HTTP/10

TR/ACE /a?c HTTP/a?c/10

HTTP /a?c HTTP/a?c/10

HTTP /a?c HTTP/a?c

17 of 40

Experiment Setup

Apache httpd

NGINX

Apache Tomcat

ATS

HAProxy

Squid

Varnish

Akamai

Cloudflare

CloudFront

18 of 40

Summary 2: T-Reqs Fuzzer and the experiment setup let us systematically analyze the body parsing behavior of servers.

19 of 40

Research Questions

Can we systematically test for HRS at scale?
What technology stacks are at risk?
What parts of a request can induce body parsing discrepancies?
What escalates a body parsing discrepancy to HRS?

20 of 40

Experiments

Request Line
Request Headers
Request Body

21 of 40

22 of 40

Category	Request Line
Distorted Protocol	GET / PTTP/1.1
Mangled Method	. / HTTP/0.9
Method Version Comb.	DELETE / HTTP/0.9
Multiple Mutations	GET / HTTP//1.1

23 of 40

Experiments

Request Line
Request Headers
Request Body

24 of 40

Category	Request Header(s)
Double Transfer-Encoding	Transfer-Encoding: identity�Transfer-Encoding: chunked
Identity Encoding	Transfer-Encoding: identity
Manipulated Termination	Transfer-Encoding: chunked {Some-Header}:{Some-Value}

25 of 40

Experiments

Request Line
Request Headers
Request Body

26 of 40

Category	Request Line
Size Data Mismatch	4\r\nBBBB\r\n
Chunk Size Termination	4\t\nBBBB\r\n
Chunk Extension Termination	4;foo=bar\r\nBBBB\r\n
Chunk Data Termination	4\r\nBBBB\r\n

27 of 40

Summary 3: Mutations in all parts of the HTTP request – request line, headers and body – can cause discrepancies between servers.

28 of 40

Research Questions

Can we systematically test for HRS at scale?
What technology stacks are at risk?
What parts of a request can induce body parsing discrepancies?
What escalates a body parsing discrepancy to HRS?

29 of 40

Testing for HRS

Technique inspired by previous research

Each pair is put together in proxy - origin
Smuggler request is sent
Benign request is sent right after
Error response from the origin server

30 of 40

Confirmed HRS

31 of 40

Confirmed HRS

32 of 40

Summary 4: Body parsing discrepancies on popular servers are opening the door to HRS.

33 of 40

Failure Conditions

Mutation not preserved

34 of 40

Failure Conditions

Mutation not preserved
Connection closed

35 of 40

Failure Conditions

Mutation not preserved
Connection closed
Exitpoint cleans

36 of 40

Summary 5: Body parsing discrepancies can be exploited for HRS only when certain conditions hold.

37 of 40

Disclosure

Apache Tomcat assigned a CVE
NGINX implemented hardening measures
ATS showed its willingness to add T-Reqs to their toolset
CloudFront discovered holes in their defense
Akamai coordinated a response with the co-author

38 of 40

Discussion

There is a lot more to explore

Non-standard HTTP headers
Non-default configurations
High number of mutations
Longer experiments

Nobody to blame

Combinations create HRS, not individual servers

39 of 40

Conclusion

We developed an HTTP fuzzer to discover new HRS attack vectors.
We designed an experimental setup for more complete and effective testing.
We also provided insights into the conditions for a discrepancy to be used for HRS.
We showed the possibility of HRS attacks on popular servers.

40 of 40

Thank You!