CRLF Powered Desync Attacks - Beheading HTTP streams

The talk starts from a common view that header injection only leads to open redirects or cross-site scripting. The speakers show that an NGINX misconfiguration, where proxy_pass is combined with a decoded URI variable, lets URL-encoded line breaks become real headers and split a single request into two. Using this, they describe response queue poisoning inside a CDN's internal infrastructure, and similar cases on telecom, e-commerce and phone-maker platforms. They also show a single-header variant that yields CL.TE desyncs, and head-request overreads that produce cache poisoning and cross-user XSS.

The middle of the talk covers cases where connections are not shared between users. The speakers use Expect 100-continue to make the proxy over-read responses, then move the desync into the victim's browser. Same-site navigation and iframes deliver the payload, leading to XSS and account takeover. They also cover response header injection, which enables cookie tossing and an XSS on redirect responses by abusing edge cache-control behaviour.

For practitioners, the main takeaway is to avoid decoding NGINX variables such as URI in proxy configuration, and to use HTTP/2 towards the upstream server. The speakers released a Burp extension, Nuclei templates for detection, sample attacker pages and labs for testing the techniques.