CAPEC 33

Summary

Attack Execution Flow

1. Identify HTTP parsing chain:

   Determine the technologies used in the target environment such as types of web servers, application firewalls, proxies, etc.

   Attack Step Techniques

   ID	Attack Step Technique Description	Environments
   1	Investigation of the target environment to determine the types of technologies used to parse the incoming HTTP requests. Attempt to understand the parsing chain traversed by the incoming HTTP request.	env-Web

   Outcomes

   ID	type	Outcome Description
   1	Success	Full HTTP parsing chain for the application has been identified

1. Probe for vulnerable differences in HTTP parsing chain:

   Attacker sends malformed HTTP Requests to the application looking for differences in the ways that individual layers in the parsing chain parse requests. When differences are identified, the attacker crafts specially malformed HTTP requests to determine if the identified parsing differences will allow extra requests to be smuggled through parsing layers.

   Attack Step Techniques

   ID	Attack Step Technique Description	Environments
   1	Create many consecutive requests to the server. Some of which must be malformed.	env-Web
   2	Use a proxy tool to record the HTTP responses headers.	env-Web

   Indicators

   ID	type	Indicator Description	Environments
   1	Positive	At some point, the server is waiting for more request information to send the last response.	env-Web
   2	Inconclusive	No response is being received.	env-Web
   3	Negative	Malformed HTTP requests are being totally ignored.	env-Web
   4	Negative	Responses are being sent even if the HTTP header is incomplete.	env-Web

   Outcomes

   ID	type	Outcome Description
   1	Success	One layer in the application's HTTP parsing chain processes HTTP Requests that other layers do not. The server smuggles the user request into the last attacker's request and transport data such as cookie, etc.
   2	Failure	The server replies with an error to the last attacker's request.
   3	Inconclusive	No response for the last incomplete request from the attacker by the server

   Security Controls

   ID	type	Security Control Description
   1	Detective	Monitor requests to the server that seem malformed.

1. Cache poisoning:

   The attacker decides to target the cache server. The server will then cache the request and serve a wrong page to a legitimate user's request. The malicious request will most likely exploit a Cross-Site Scripting or another injection typed vulnerability.

   Attack Step Techniques

   ID	Attack Step Technique Description	Environments
   1	Leverage the vulnerabilities identified in the Experiment Phase to inject malicious HTTP request that contains HTTP Request syntax that will be processed and acted on by the outer parsing layer of the cache server but not by the inner application layer. In this way it will be cached by the server without obvious sign from the application and the corrupt data will be served to future requesters.	env-Web

   Outcomes

   ID	type	Outcome Description
   1	Success	The attacker gets the users to be served with this cached malicious HTTP request.

   Security Controls

   ID	type	Security Control Description
   1	Detective	Monitor server logs for consecutive suspicious HTTP requests.

2. Session Hijacking:

   The attacker decides to target the web server by crafting a malicious HTTP Request containing a second HTTP Request using syntax that will not be processed and acted on by an outer "filter" parsing layer but will be acted on by the inner web server/application processing layers. The application/web server will then act on the malicious HTTP Request as if it is a valid request from the client potentially subverting session management.

   Attack Step Techniques

   ID	Attack Step Technique Description	Environments
   1	Leverage the vulnerabilities identified in the Experiment Phase to inject malicious HTTP request that contains HTTP Request syntax that will not be processed and acted on by the outer parsing layer of the malicious content filters but will be by the inner application/web server layer. In this way it will be acted on by the application/web server as if it is a valid request from the client.	env-Web

   Outcomes

   ID	type	Outcome Description
   1	Success	The attacker gets the application/web server to act on the malicious HTTP request and allows the attacker to gain control of the target user's session.

   Security Controls

   ID	type	Security Control Description
   1	Preventative	Monitor server logs for consecutive suspicious HTTP requests.

Likelihood: Medium

Description

Related Vulnerabilities

Description

Related Vulnerabilities

Skill or Knowledge Level: High

The attacker has to have detailed knowledge of the HTTP protocol specifics and must also possess exact details on the discrepancies between the two targeted entities in parsing HTTP requests.

If system documentation is available, the attacker can look up the exact versions of the two targeted entities, since different versions of the same system often behave differently. The attacker can also use product-specific documentation to figure out differences in parsing HTTP requests between the two entities.

In case where no documentation is available, the attacker needs to reliably fingerprint the targeted entities to discover the nature and version of the entities. Having done this, the attacker then needs to experimentally determine how the two entities differ in parsing requests.

Differences in requests processed by the two entities. This requires careful monitoring or a capable log analysis tool.

HTTP Request Smuggling is usually targeted at web servers. Therefore, in such cases, careful analysis of the entities must occur during system design prior to deployment. If there are known differences in the way the entities parse HTTP requests, the choice of entities needs consideration.

Employing an application firewall can help. However, there are instances of the firewalls being susceptible to HTTP Request Smuggling as well.

System integration testing must include security checks to protect against Multiple Interpretation Errors across systems.

CWE - HTTP Request Smuggling

CWE - Multiple Interpretation Error