Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by kingcharles on Thursday November 11, 2021 @01:00PM (#29190919)

I'm guessing they just check what each line starts with. Then they probably split the line on the : to get the value. That would produce the results seen.

It shows just how careful you have to be when writing code that is Internet-facing, and especially on the scale of AWS where you have half the world's hackers trying to find exploits.

I'm not even looking for exploits and I find them every day. For instance, I wanted to read some magazines the other day but they were behind a paywall. Just to see what was behind the wall I checked for a sitemap file. 35MB sitemap.xml contains direct links to the full downloads of every item with no auth needed.

[ Parent | on HN ]

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by thephyber on Thursday November 11, 2021 @04:10PM (#29193215)

> It shows just how careful you have to be when writing code that is Internet-facing

All code. “Internet facing” is not the only relevant qualification.

Any code where user-generated code is parsed should be carefully written, tested, and documented. Edge cases should be identified and described in specs. Non-compliant software should be identified and shamed (or preferably PRed).

I know that AWS has already patched some HTTP Smuggling attacks maybe 3 years ago, but I don’t remember if is was the same AWS feature (the previous one might have been CloudFront) and the parsing error might have been a little different.

[ Parent | on HN ]