HTTP Request Smuggling on https://labs.data.gov

Program: GSA Bounty Bug Type: HTTP request smuggling Bounty: 750 Date: 2019-10-31
http-request-smuggling http1.1-must-die desync

Summary

The researcher found an HTTP request smuggling (TE.CL) vulnerability in an application where the frontend uses Transfer encoding header and the backend uses Content Length. To reproduce the vulnerability the reporter had set a POST request to '/' followed by a POST request to '/hopefully404', the reported also made sure to send a batch of request after to prevent the attack affecting innocent users. The attacker url was reportedly reflected in the response html as well.

References