Breaking HTTP Servers Using the HTTP Garden

The talk opens with a refresher on HTTP/1.1 requests and connection reuse through pipelining. The researchers, funded to study parser differentials, first demonstrate an embedded web server, Mongoose, that loops forever when a pipelined request carries a negative content length. They then show LightSpeed, which accepts a leading zero in a content length header and parses it differently than a proxy would, desynchronizing a pipelined pair.

Placing HAProxy in front of the vulnerable server turns these disagreements into security problems. Mismatched message boundaries let a request slip past an access control list, smuggle an extra request, and poison a cache so a private key was served to anyone. Later sections examine whitespace and chunk extensions in the spec, where carriage return handling differs across Apache Traffic Server, Node.js and cloud load balancers, letting a blocked DELETE request through. Google issued bounties for related findings, while Akamai, affected by the same bypass, had no public bounty program at the time.

To find these bugs, the team built what they call the HTTP garden: a driver sends crafted payloads through many real servers and proxies, each echoing back how it parsed the request, and the results are compared. A coverage-guided differential fuzzer with an HTTP grammar generates new inputs. The takeaways are to never assume two parsers agree, to fuzz rewritten parsers against existing implementations, and not to rely on a proxy's access controls alone.