Response Smuggling: Pwning HTTP/1.1 Connections

Expanding Beyond HTTP Request Smuggling

While HTTP request smuggling focuses on manipulating incoming requests between reverse proxies and backends, response handling pipelines represent an equally dangerous attack surface.

Introducing HTTP Response Smuggling

Martin Doyhenard analyzes how reverse proxies parse backend HTTP/1.1 response headers, uncovering discrepancies in `Content-Length` and `Transfer-Encoding` processing.

Poisoning Web Caches and Capturing Sensitive Responses

By smuggling premature HTTP responses into shared connection pools, an attacker pairs malicious responses with subsequent benign user requests, hijacking sessions and stealing credentials.

Defensive Architecture for HTTP Reverse Proxies

Doyhenard provides web application firewall (WAF) rule sets and connection isolation recommendations to eliminate response pipeline desynchronization.