Smuggling Requests with Chunked Extensions: A New HTTP Desync Trick

A new HTTP request smuggling technique was recently discovered, where attackers take advantage of inconsistent parsing behaviors between front-end proxy servers and back-end application servers. This attack technique leverages ambiguous request formatting to inject malicious secondary requests that appear after fabricated request terminations, effectively circumventing established security controls. Following a responsible disclosure, we have implemented […]

The post Smuggling Requests with Chunked Extensions: A New HTTP Desync Trick appeared first on Blog.