Security researchers Tom Stacey from PortSwigger and Tobia Righi from TurtleSec have unveiled a groundbreaking method within the realm of cyber threats, categorizing it as a new type of HTTP request smuggling attack branded as “CRLF-Powered Desync Attacks.” This innovative and sophisticated technique exploits an often-overlooked vulnerability related to HTTP header injection that has the potential to lead to severe security violations, including full account takeovers, unauthorized access to HTTPOnly cookies, and even the creation of self-replicating desync worms.
New CRLF Desync Attack
The crux of the CRLF-Powered Desync Attack centers around a frequent misconfiguration within the Nginx web server, specifically when the $uri variable is improperly handled in the proxy_pass directive. This misconfiguration results in Nginx URL-decoding the request path before it is sent upstream, inadvertently including any CRLF (Carriage Return and Line Feed) sequences encoded as (%0d%0a). By doing so, it opens the door for attackers to inject arbitrary newlines and headers into the HTTP requests that are relayed to backend servers. This transformation of what appears to be a trivial header-injection glitch into a mechanism for complete control over the structure of the upstream HTTP request marks a significant development in the field of cybersecurity.
The researchers illustrated the effectiveness of their technique by demonstrating how attackers could split a single malicious request into two separate and complete requests using sequential CRLF sequences. This approach can trigger a phenomenon known as Response Queue Poisoning (RQP). Originally conceptualized by noted security expert James Kettle, RQP involves the server losing track of the responses corresponding to each client, leading to scenarios where users inadvertently receive responses intended for others. In one notable case, the vulnerability was traced deep within a content delivery network’s shared infrastructure, which allowed the researchers to intercept session cookies and authentication tokens coming from thousands of unrelated applications running on the same platform.
Beyond these basic exploits, the team also showcased advanced CL.TE (Content-Length/Transfer-Encoding) desynchronization attacks achieved with minimal effort by simply injecting a single Transfer-Encoding header. This clever approach enabled them to evade defenses that would typically thwart standard double-CRLF request splitting. Their success was notably recognized when they executed the exploit against a major telecommunications provider, resulting in a significant bounty of $20,000 after extracting internal access tokens through the exploitation of 500 concurrent connections over an extended period.
Additionally, a flaw in a payment provider’s handling of session cookies led to the exposure of credit card information and other personally identifiable information (PII) across multiple companies utilizing the same Kubernetes-hosted infrastructure. This alarming discovery underscores the wide-reaching implications of CRLF-Powered Desync Attacks, necessitating immediate actions from organizations to safeguard their systems.
Browser-Based Exploitation and HTTPOnly Cookie Theft
Adding to the gravity of their findings, Stacey and Righi built upon previous research related to “Browser-Powered Desync Attacks.” They revealed that most CRLF-powered desyncs can be activated directly from a victim’s browser using JavaScript fetch() commands or simple navigation techniques, eliminating the necessity for direct network access to the backend. This browser-based method allows attackers to circumvent protections typically put in place to prevent cross-network exploitation based on IP or connection, effectively generating cross-site scripting attacks without any direct involvement from the attacker.
One of the most concerning aspects of their research involves the newly demonstrated potential for desync worms. In this scenario, a victimized browser—once compromised via injected XSS—can be manipulated as a platform from which subsequent fetch-based desync attacks can be launched against other users. This could result in the exploit propagating exponentially, significantly amplifying the original threat without requiring further action from the attacker.
The findings were illustrated through several case studies presented by PortSwigger. They highlighted various vulnerabilities, including those found in a major phone manufacturer’s account subdomain, which opened the door to blind XSS attacks from devices worldwide, and a social media CDN susceptible to cache poisoning via HEAD request manipulation. A notable incident was reported with a clothing retailer, where a testing error inadvertently led to the hijacking of live shopping sessions, ultimately escalating into full account takeovers through email replacements, resulting in a bounty reward of $2,200.
Organizations utilizing Nginx configurations containing the $uri variable within proxy_pass directives are strongly urged to undertake an immediate audit of their systems. This specific misconfiguration is at the heart of the majority of incidents reported thus far. The research, demonstrated at significant cybersecurity forums like Black Hat USA and DEF CON, powerfully illustrates that what once may have been regarded as a low-severity header injection issue can escalate into critical, wormable vulnerabilities when combined with request smuggling tactics and browser execution contexts.
As the landscape of cybersecurity continues to evolve, incidents that arise from sluggish investigations can lead to profound consequences. Consequently, organizations are encouraged to enhance their threat intelligence capabilities to better position themselves against potential threats posed by sophisticated exploits such as CRLF-Powered Desync Attacks.