CWE-444 is Inconsistent Interpretation of HTTP Requests, better known as HTTP request or response smuggling. It applies when a proxy, firewall or load balancer sits between a client and a server but reads malformed messages differently from the way the destination does.
If you run a reverse proxy, a CDN, a web application firewall or a caching layer in front of an application server, this is your weakness.
How it happens
HTTP messages can be malformed or ambiguous. Two components can read the same bytes and disagree about where one message ends and the next begins. MITRE points to duplicate or conflicting header fields as the classic trigger, for example two Content-Length headers, two Transfer-Encoding headers, or a message carrying both.
The attacker crafts one request. The intermediary sees it as one message. The back end sees it as two. The hidden second message is smuggled past anything the intermediary was supposed to check.
MITRE's example sends a POST with two Content-Length headers to a site fronted by a proxy:
POST http://www.website.com/foobar.html HTTP/1.1
Host: www.website.com
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Content-Length: 54
GET /poison.html HTTP/1.1
Host: www.website.com
Bla: GET http://www.website.com/page_to_poison.html HTTP/1.1
...
The proxy ignores the first Content-Length header, so it treats the next 54 bytes as the first request's body and then parses what remains as a second request. The web server does the opposite. It uses the first Content-Length header, decides the POST has no body, and parses the leftover bytes as a separate request. The two sides disagree about the message boundaries, which MITRE shows being used for web cache poisoning.
MITRE says the weakness is usually the result of outdated or incompatible HTTP protocol versions in the HTTP agents. Observed examples:
- CVE-2020-8287: Node.js allowed request smuggling via two Transfer-Encoding headers.
- CVE-2021-37147: a caching proxy had improper header validation, allowing response smuggling using an LF line ending.
- CVE-2022-24766: an SSL/TLS-capable proxy allowed smuggling when used with HTTP/1.0 services.
- CVE-2006-6276: web servers allowed request smuggling via inconsistent HTTP headers.
What an attacker gains
MITRE's consequence list covers integrity, non-repudiation, access control, an unexpected state, hidden activity and a bypass of protection mechanisms. Concretely, MITRE names three outcomes: tricking the web server into associating a URL with another URL's page and caching it (web cache poisoning), structuring a message to bypass firewall protections and reach a web application, and invoking a script or page that returns client credentials, similar to cross-site scripting.
How to find it
MITRE lists automated static analysis as one detection method, though smuggling lives mostly in the interaction between components, so hands-on testing matters more:
- Map every hop between the internet and your application, and note the software and version at each hop.
- Test the full chain with conflicting Content-Length and Transfer-Encoding headers, duplicate headers and odd line endings.
- Watch for cache entries that map to the wrong content.
- A dynamic scan of the live site can reveal parsing differences that source review cannot.
How to fix it
MITRE's mitigations:
- Use a web server that employs strict HTTP parsing, such as Apache.
- Use only SSL communication.
- Terminate the client session after each request.
- Turn all pages to non-cacheable.
Beyond those, keep the proxy and the back end on current, matching HTTP implementations, because outdated versions are the stated root cause. Many of the observed CVEs above are bugs in proxy and server software, so patching matters. Safeguard's free in-browser dependency scan checks your dependency list for known issues, with no login and the file staying on your machine, up to 100 dependencies.
Try it yourself
A dynamic scan of a running site is one way to look for parsing differences between layers.
Click through it at your own pace, or open it full screen.
Quick check
What is the root cause of request smuggling?
An intermediary and the destination parse the same HTTP message differently, often because of duplicate or conflicting headers or mismatched protocol versions.
Why does disabling caching help?
Cache poisoning is one outcome of smuggling. If pages are not cacheable, a smuggled message cannot leave a bad entry behind for other users. It does not remove the parsing difference itself.
