CRLF Injection Evolves into 'Desync Worm' Attacks
Researchers have detailed a new class of HTTP desynchronization attacks, dubbed 'CRLF-Powered Desync Worms,' that leverage header injection flaws to hijack user sessions and bypass security measures.
Security researchers have unveiled a significant evolution in HTTP header injection vulnerabilities, demonstrating how a common flaw can be weaponized into a potent "CRLF-Powered Desync Worm." This new attack vector moves beyond traditional exploits like Cross-Site Scripting (XSS) or open redirects, enabling attackers to desynchronize HTTP request streams and hijack other users' sessions with potentially catastrophic consequences.
The core of the attack lies in HTTP header injection, a vulnerability that allows attackers to inject malicious headers into HTTP requests. When combined with CRLF (Carriage Return Line Feed) characters, these injections can manipulate how web servers and proxies process requests. The research highlights that this technique is severely underestimated, with its true potential for widespread disruption only now being fully explored. By transforming a simple header injection primitive, attackers can create a self-propagating attack that targets multiple users.
Novel methods have been developed to detect and exploit specific types of desyncs, including IP and connection-locked desyncs. While these typically limit exploitation to within the same network, the researchers have devised techniques to bypass these limitations. By shifting the desync's execution into the victim's browser, attackers can effectively generate XSS vulnerabilities out of thin air, enabling them to steal sensitive data such as HTTPOnly cookies.
The research also addresses the risks of accidental desynchronization. For instance, a misconfigured attack could inadvertently log every active user of a target application into the attacker's own account. This could lead to chaotic scenarios, such as a user's shopping cart being overwritten with random items from other users' sessions on every page refresh, demonstrating the potential for widespread disruption even without malicious intent.
Historically, HTTP request smuggling vulnerabilities have been explored, with prior research focusing on techniques like response queue poisoning via request splitting. However, this new research pushes the boundaries by demonstrating how header injection can be directly leveraged for desynchronization attacks, particularly in environments using popular web servers like Nginx. Misconfigurations in Nginx, specifically involving the $uri variable in proxy_pass directives, can normalize URL-encoded CRLF sequences, granting attackers control over the forwarded request structure.
Detecting these header injection flaws is described as relatively straightforward. Attackers can inject invalid HTTP syntax or headers, such as a malformed Transfer-Encoding or an arbitrary Foo: bar header, to elicit predictable error responses from the server. This allows for the identification of potential injection points before attempting more complex desync attacks.
The implications of CRLF-powered desync attacks are far-reaching. They can be used to poison web caches, bypass access controls, and execute arbitrary commands. The research also details how these techniques can be used to steal HTTPOnly cookies, a critical piece of sensitive information that is typically protected from JavaScript access, further highlighting the severity of these vulnerabilities.
This comprehensive research, co-authored with Tobia Righi from TurtleSec, was presented at major security conferences like Black Hat USA and DEF CON. It aims to educate the security community about the underestimated threat posed by HTTP header injection and CRLF-based desynchronization techniques, urging developers and security professionals to implement robust defenses against these evolving attack vectors.