HTTP Header Injection Escalated to Critical Desync Attacks with Single Prompt
Researchers have developed a novel technique to elevate HTTP header injection vulnerabilities into critical CRLF-powered desynchronization attacks, enabling redirection of users to attacker-controlled servers with a single malicious prompt.
Security researchers have unveiled a significant advancement in exploiting web vulnerabilities, demonstrating a new method to escalate previously less severe HTTP header injection flaws into critical CRLF-powered desynchronization (desync) attacks. This technique allows attackers to redirect unsuspecting users to arbitrary collaborator servers by crafting a single malicious prompt, dramatically increasing the potential impact of these vulnerabilities.
The methodology, detailed by PortSwigger Research, leverages Burp Suite's Automated Testing (AT) capabilities to autonomously perform a multi-phase process. The core idea is to exploit HTTP request header injection to achieve request splitting, a fundamental component of desync attacks. The process begins by identifying the precise location where injected headers are processed by the upstream server, which may differ from where they are initially inserted.
Phase two of the methodology focuses on validating the desync through request splitting. This involves constructing specific payloads that manipulate the HTTP request stream, aiming to elicit distinct responses from the server based on how it interprets the split requests. By observing unique status codes, the skill confirms that the injected headers are indeed causing a desynchronization between the client and server.
Once a desync is validated, the next phase involves finding an "exploit gadget." This typically means identifying open redirect vulnerabilities within the target application that can be triggered by manipulating headers like Host or X-Forwarded-Host, or by using absolute URLs. The research team's skill performs a mini-crawl to discover these potential redirection points.
Finally, in phase four, the identified desync primitive and the exploit gadget are combined to craft a malicious request. For instance, an attacker could inject a header that causes the server to redirect the user's browser to an attacker-controlled domain. This is achieved by sending a specially crafted request that, when processed by the desynchronized server, results in a redirect response being served to the victim.
While the researchers acknowledge that more destructive exploitation routes like Response Queue Poisoning exist, they opted for a safer redirection-based exploit to minimize the risk to end-users during testing. However, they note that this primitive can be chained with other techniques, such as cache poisoning, to achieve more severe outcomes like full-site takeovers.
The development of these Burp AT skills aims to make cutting-edge research findings practical and accessible to security testers quickly. The skills are designed to handle various edge cases and provide clear findings, either as a full exploit or a validated desync vulnerability that testers can further investigate. This advancement empowers security professionals to detect and exploit complex vulnerabilities more efficiently.