How HTTP Request Smuggling Vulnerability Gets You a $750 Bug Bounty

A recent security assessment uncovered a critical HTTP Request Smuggling vulnerability on a web application. This vulnerability stems from a discrepancy in how the front-end and back-end servers process HTTP requests. The front-end server relies on the Transfer-Encoding header, while the back-end server uses the Content-Length header, creating an opportunity for resynchronization. In one particular instance, discovering and reporting this vulnerability earned a $750 bug bounty. In this article, we’ll break down the steps of this attack, explain how it works, and show how even a beginner can start performing and detecting this vulnerability.

HTTP Request Smuggling is an attack that happens when two servers (usually a front-end proxy and a back-end server) interpret the same HTTP request differently. This occurs due to inconsistencies in the way the front-end and back-end servers handle certain headers, such as Content-Length and Transfer-Encoding.

For example: