Other nomination
Funky chunks: abusing ambiguous chunk line terminators for request smuggling
HTTP implementations disagree over what ends a line in a chunked body: some read a bare newline inside a chunk extension as a terminator, others swallow it, and some accept any two bytes after an oversized chunk body. Pairing a proxy and server with complementary leniencies desynchronises them and smuggles a request past front-end controls.
Record
- Researcher
- Jeppe Bonde Weikop
- Date
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Jeppe Bonde Weikop, first published at the original source. Preserved copies are kept so the citation survives its host.