Exécuter une analyse statique (SAST) sur le code source à la recherche du motif non sécurisé dans le flux de données.
CWE-444 Base Incomplet
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
This weakness occurs when a proxy, firewall, or other intermediary HTTP agent interprets a malformed HTTP request or response differently than the final destination server or client. This…
Définition
What is CWE-444?
This weakness occurs when a proxy, firewall, or other intermediary HTTP agent interprets a malformed HTTP request or response differently than the final destination server or client. This inconsistency allows an attacker to craft messages that bypass the intermediary's security checks.
HTTP request smuggling exploits differences in how web servers, clients, and intermediary devices (like load balancers, reverse proxies, or WAFs) parse ambiguous HTTP messages. An attacker can inject conflicting headers—such as duplicate `Content-Length` or `Transfer-Encoding` fields—causing the intermediary and the backend server to see two different requests or responses in the same network stream. This lets malicious traffic slip through undetected.
This vulnerability typically stems from using outdated HTTP parsing libraries or mismatched protocol versions between system components. To prevent it, developers must ensure all HTTP agents in the data flow use consistent, up-to-date parsing logic and rigorously validate message formatting.
Impact réel
Real-world CVEs caused by CWE-444
-
SSL/TLS-capable proxy allows HTTP smuggling when used in tandem with HTTP/1.0 services, due to inconsistent interpretation and input sanitization of HTTP messages within the body of another message
-
Chain: caching proxy server has improper input validation (CWE-20) of headers, allowing HTTP response smuggling (CWE-444) using an "LF line ending"
-
Node.js platform allows request smuggling via two Transfer-Encoding headers
-
Web servers allow request smuggling via inconsistent HTTP headers.
-
HTTP server allows request smuggling with both a "Transfer-Encoding: chunked" header and a Content-Length header
-
HTTP server allows request smuggling with both a "Transfer-Encoding: chunked" header and a Content-Length header
Comment les attaquants l'exploitent
Parcours de l'attaquant étape par étape
- 1
In the following example, a malformed HTTP request is sent to a website that includes a proxy server and a web server with the intent of poisoning the cache to associate one webpage with another malicious webpage.
- 2
When this request is sent to the proxy server, the proxy server parses the first four lines of the POST request and encounters the two "Content-Length" headers. The proxy server ignores the first header, so it assumes the request has a body of length 54 bytes. Therefore, it treats the data in the next three lines that contain exactly 54 bytes as the first request's body:
- 3
The proxy then parses the remaining bytes, which it treats as the client's second request:
- 4
The original request is forwarded by the proxy server to the web server. Unlike the proxy, the web server uses the first "Content-Length" header and considers that the first POST request has no body.
- 5
Because the web server has assumed the original POST request was length 0, it parses the second request that follows, i.e. for GET /poison.html:
Exemple de code vulnérable
Vulnerable code
In the following example, a malformed HTTP request is sent to a website that includes a proxy server and a web server with the intent of poisoning the cache to associate one webpage with another malicious webpage.
POST http://www.website.com/foobar.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Content-Length: 54
GET /poison.html HTTP/1.1
Host: www.website.com
Bla: GET http://www.website.com/page_to_poison.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive Charge utile de l'attaquant
In the following example, a malformed HTTP request is sent to a website that includes a proxy server and a web server with the intent of poisoning the cache to associate one webpage with another malicious webpage.
POST http://www.website.com/foobar.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Content-Length: 54
GET /poison.html HTTP/1.1
Host: www.website.com
Bla: GET http://www.website.com/page_to_poison.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive Exemple de code sécurisé
Secure Java
Additionally, if a web application includes a Java servlet for processing requests, the servlet can check for multiple "Content-Length" headers and if they are found the servlet can return an error response thereby preventing the poison page to be cached, as shown below.
protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
```
// Set up response writer object*
...
try {
```
```
// check for multiple content length headers*
Enumeration contentLengthHeaders = request.getHeaders("Content-Length");
int count = 0;
while (contentLengthHeaders.hasMoreElements()) {
```
count++;
}
if (count > 1) {
```
// output error response* }
else {
```
```
// process request* }
} catch (Exception ex) {...}} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Liste de contrôle de prévention
How to prevent CWE-444
- Implementation Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
- Implementation Use only SSL communication.
- Implementation Terminate the client session after each request.
- System Configuration Turn all pages to non-cacheable.
Signaux de détection
How to detect CWE-444
Exécuter des tests de sécurité applicative dynamique (DAST) contre le point de terminaison en ligne.
Surveiller les journaux runtime pour détecter des traces d'exception inhabituelles, des entrées malformées ou des tentatives de contournement d'autorisation.
Revue de code : signaler tout nouveau code qui traite les entrées de cette surface sans utiliser les helpers du framework validés.
Plexicus détecte automatiquement CWE-444 et ouvre une PR de correction en moins de 60 secondes.
Codex Remedium analyse chaque commit, identifie cette faiblesse précise et livre une pull request prête à être relue avec le correctif. Pas de tickets. Pas de transferts.
Questions fréquentes Qu'est-ce que CWE-444 ?
Quelle est la gravité de CWE-444 ?
Quels langages ou plateformes sont affectés par CWE-444 ?
Comment puis-je prévenir CWE-444 ?
Comment Plexicus détecte et corrige CWE-444 ?
Où puis-je en savoir plus sur CWE-444 ?
Frequently asked questions
Qu'est-ce que CWE-444 ?
This weakness occurs when a proxy, firewall, or other intermediary HTTP agent interprets a malformed HTTP request or response differently than the final destination server or client. This inconsistency allows an attacker to craft messages that bypass the intermediary's security checks.
Quelle est la gravité de CWE-444 ?
MITRE n'a pas publié de note de probabilité d'exploitation pour cette faiblesse. Traitez-la comme un impact moyen jusqu'à ce que votre modèle de menace prouve le contraire.
Quels langages ou plateformes sont affectés par CWE-444 ?
MITRE lists the following affected platforms: Web Based.
Comment puis-je prévenir CWE-444 ?
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433]. Use only SSL communication.
Comment Plexicus détecte et corrige CWE-444 ?
Le moteur SAST de Plexicus reconnaît la signature de flux de données de CWE-444 à chaque commit. Lorsqu'une correspondance est trouvée, notre agent Codex Remedium ouvre une PR de correction avec le code corrigé, les tests et un résumé d'une ligne pour le relecteur.
Où puis-je en savoir plus sur CWE-444 ?
MITRE publie la définition canonique à https://cwe.mitre.org/data/definitions/444.html. Vous pouvez également consulter la documentation OWASP et NIST pour des conseils adjacents.
Faiblesses associées
Weaknesses related to CWE-444
CWE-436 Parent
Interpretation Conflict
An interpretation conflict occurs when two systems process the same data or sequence of events differently, leading one system to make…
CWE-113 Frère
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
This vulnerability occurs when an application accepts user-supplied data and includes it directly in HTTP headers without properly…
CWE-115 Frère
Misinterpretation of Input
This vulnerability occurs when software incorrectly interprets or processes input data, leading to unintended and potentially harmful…
CWE-437 Frère
Incomplete Model of Endpoint Features
This vulnerability occurs when a security product, proxy, or monitoring system sits between endpoints but lacks a full understanding of…
CWE-626 Frère
Null Byte Interaction Error (Poison Null Byte)
This vulnerability occurs when software incorrectly processes null bytes (NUL characters) as data moves between different systems or…
CWE-650 Frère
Trusting HTTP Permission Methods on the Server Side
This vulnerability occurs when a server incorrectly assumes that HTTP GET requests are always safe and cannot change server-side data.…
CWE-86 Frère
Improper Neutralization of Invalid Characters in Identifiers in Web Pages
This vulnerability occurs when an application fails to properly filter or escape invalid characters within web identifiers like HTML tag…
Ressources
Further reading
- MITRE — CWE-444 officiel https://cwe.mitre.org/data/definitions/444.html
- HTTP Request Smuggling https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf
- HTTP Response Smuggling http://projects.webappsec.org/w/page/13246930/HTTP%20Response%20Smuggling
- HTTP Request Smuggling: Complete Guide to Attack Types and Prevention https://brightsec.com/blog/http-request-smuggling-hrs/
- A Pentester's Guide to HTTP Request Smuggling https://www.cobalt.io/blog/a-pentesters-guide-to-http-request-smuggling
- HTTP Desync Attacks in the Wild and How to Defend Against Them https://www.imperva.com/blog/archive/http-desync-attacks-and-defence-methods/
- HTTP Desync Attacks: Request Smuggling Reborn https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
Prêt quand vous l'êtes
Arrêtez de payer par développeur.
Commencez à fermer la boucle.
Plexicus est l'ASPM natif IA qui scanne, filtre, corrige, penteste et explique — de façon autonome. Développeurs illimités, dépôts illimités, actions IA à usage équitable. Vrai niveau gratuit, €269/mo annuel quand vous êtes prêt.