HTTP/1.1 Must Die! The Desync Endgame

Overview: James Kettle, Director of Research at PortSwigger, presents a comprehensive dissection of the persistent, systemic vulnerabilities inherent to HTTP/1.1 request smuggling. Drawing on six years of pioneering desync research, Kettle demonstrates how industry defenses—specifically WAF regular expressions and front-end HTTP/2 downgrades—have merely masked detection tooling while exacerbating underlying parser discrepancies. The talk releases HTTP Request Smuggler version 3 and introduces novel attack classes, including 0.CL desyncs and Expect-header exploitation across major CDNs.

Key Topics: - Structural flaws of HTTP/1.1 request boundaries and parser discrepancies - Failures of regex-based WAF filtering and internal HTTP/2-to-HTTP/1 downgrading - Release of HTTP Request Smuggler v3 and parser differential testing - Practical 0.CL desyncs via Windows IIS device name early-response gadgets - Expect header exploitation, response queue poisoning, and CDN mass takeovers

Technical Details: Kettle details how the lack of explicit message framing in HTTP/1.1 makes request isolation fundamentally fragile whenever requests transit reverse proxies and load balancers. Although organizations adopt HTTP/2 at the perimeter, edge reverse proxies routinely downgrade requests to HTTP/1.1 for backend routing. Defensive teams deployed regular expression filters to block traditional `Transfer-Encoding: chunked` probes, which blinded automated scanners without fixing the underlying parser divergence. Kettle illustrated the danger with a real-world Cloudflare vulnerability: requests converted from H2 to H1 internally and back to H2 suffered an edge-cache desync when a test probe omitted a cache buster, enabling persistent request hijacking across 24 million hosted websites.

To overcome regex filtering, Kettle released HTTP Request Smuggler v3, an open-source Burp Suite extension that uses parser differential classification. By space-masking headers (such as `Host` or `Content-Length`) and observing differential status codes, the tool identifies visible/hidden parser discrepancies. Addressing scenarios where frontends hide `Content-Length` (causing a theoretical 0.CL desync that typically deadlocks connections waiting for the body), Kettle discovered early-response gadgets. On Windows IIS servers, querying DOS device namespace paths (like `/con`) causes IIS to respond early without terminating the TCP connection. By chaining this gadget with a "double desync" that slices headers from an intermediate attacker request, he turned a 0.CL desync into a weaponized CL.0 desync to capture live victim sessions.

The presentation also revealed extensive vulnerabilities centered on the `Expect` header (`Expect: 100-continue`). Because `Expect` introduces statefulness and multiple response header blocks, it frequently triggers memory leaks, reveals stripped internal proxy headers (as shown across the Netlify CDN), and initiates desyncs. Collaborating with top bug hunters, Kettle leveraged Expect-header desyncs to execute response queue poisoning against GitLab's bug bounty infrastructure (leaking private vulnerability reports for a $7,000 bounty), T-Mobile ($12,000 bounty), Netlify, and Akamai CDN. The Akamai vulnerability allowed account takeover on `auth.lastpass.com` and arbitrary response hijacking across enterprise domains, taking total bounties past $350,000.

Key Takeaways: Organizations must eliminate upstream HTTP/1.1 downgrades by enforcing end-to-end HTTP/2 or HTTP/3 with unambiguous binary framing across all internal proxies and microservices. Web application firewalls and regex pattern matching cannot reliably mitigate desync vulnerabilities and frequently introduce new parsing inconsistencies. Security teams should audit proxy pipelines using parser differential tooling like HTTP Request Smuggler v3 to detect hidden/visible header handling anomalies before attackers exploit connection-pooling discrepancies.

(AI summary — Gemini Flash)