Simplifying HTTP Desync Attacks Using the TRACE Method
PortSwigger researcher Martin Doyhenard introduces a novel exploitation technique for HTTP desync vulnerabilities, also known as request smuggling, by leveraging the often-overlooked TRACE HTTP method. The article addresses the challenge of exploiting desync flaws when traditional vectors like reflected parameters or isolated backend connections are unavailable. Doyhenard demonstrates that many popular web servers, including Apache, IIS, and Tomcat, support TRACE by default, allowing attackers to receive a loop-back of the exact request received by the backend. This visibility reveals header modifications and protocol downgrades critical for crafting exploits. By combining TRACE with response smuggling and web cache poisoning, attackers can bypass complex constraints. Specifically, the technique involves smuggling a HEAD request to manipulate response queues and using TRACE responses to construct payloads that completely compromise web applications. This research highlights the persistent security risks associated with legacy HTTP methods and provides a practical proof-of-concept for demonstrating the severe impact of seemingly unexploitable desync vulnerabilities in modern bug bounty programs.
Wire timeline
Simplifying HTTP Desync Attacks Using the TRACE Method
PortSwigger researcher Martin Doyhenard introduces a novel exploitation technique for HTTP desync vulnerabilities, also known as request smuggling, by leveraging the often-overlooked TRACE HTTP method. The article addresses the challenge of exploiting desync flaws when traditional vectors like reflected parameters or isolated backend connections are unavailable. Doyhenard demonstrates that many popular web servers, including Apache, IIS, and Tomcat, support TRACE by default, allowing attackers to receive a loop-back of the exact request received by the backend. This visibility reveals header modifications and protocol downgrades critical for crafting exploits. By combining TRACE with response smuggling and web cache poisoning, attackers can bypass complex constraints. Specifically, the technique involves smuggling a HEAD request to manipulate response queues and using TRACE responses to construct payloads that completely compromise web applications. This research highlights the persistent security risks associated with legacy HTTP methods and provides a practical proof-of-concept for demonstrating the severe impact of seemingly unexploitable desync vulnerabilities in modern bug bounty programs.
PortSwigger Research