CRLF-Powered Desync: When Header Injection Turns into Request Smuggling

CRLF-Powered Desync: When Header Injection Turns into Request Smuggling

Researchers Tom Stacey (PortSwigger) and Tobia Righi (TurtleSec) presented their research, CRLF-Powered Desync Attacks. The key takeaway: HTTP Header Injection is often underestimated — the ability to inject CRLF can escalate into full-blown HTTP desync / request smuggling, affecting other users.

One common source of the issue is using $uri inside proxy_pass in Nginx. he server normalizes the request path and URL-decodes encoded characters, including CRLF sequences (%0d%0a), allowing them to be injected into the request forwarded upstream and giving the attacker control over its structure.

From CRLF to desync If two consecutive CRLFs can be injected, the original request can be split into two, enabling Response Queue Poisoning (RQP): the server loses track of which response belongs to which request, potentially causing responses intended for other users to be sent to the attacker. On one CDN, the researchers triggered RQP inside the provider's own infrastructure, ultimately capturing other users' requests, including session cookies and auth tokens for thousands of applications hosted on the CDN. At a major telecommunications provider, a similar Header Injection allowed them to steal access tokens from internal infrastructure and earned a $2,200 bounty. But even if two consecutive CRLF sequences are blocked, injecting a single header may be enough. By adding Transfer-Encoding: chunked to a request with Content-Length, the researchers achieved a classic CL.TE desync. At a popular clothing store, the technique allowed them to replace active users' email addresses and take over their accounts. On a major smartphone manufacturer's domain, the desync was escalated to XSS and then to account takeover.

Desync from the browser One key finding is that the vast majority of CRLF-powered desync attacks can be triggered through fetch() or even basic browser navigation. This shifts execution into the victim's browser and opens up exploitation opportunities for connection-locked and IP-locked desyncs that normally prevent cross-user attacks. The researchers also showed how CRLF-powered desync can make James Kettle's previously theorized desync worm practical: XSS in a victim's browser can use fetch() to trigger the same desync against further users, creating a self-replicating attack. In other scenarios, combining request splitting with HEAD and Range made it possible to achieve XSS, extract authentication tokens, and even make an HttpOnly session cookie accessible to JavaScript.

HTTP Header Injection should not automatically be considered a low-impact vulnerability. A CRLF injection can serve as the basis for request splitting, CL.TE/0.CL desync, RQP, XSS, and user account compromise.

Article: https://portswigger.net/research/crlf-powered-desync-attacks