注入与走私

前后端对同一个请求理解不一致时就会出现走私；把数据当成指令解析时就会出现注入。

影响

投毒缓存、劫持其他用户的请求，或读取服务端内部文件

观察点

后端对请求边界的解析与前端代理不一致，后续请求被污染

修复

统一前后端的 HTTP 解析实现，拒绝含糊的 Content-Length / Transfer-Encoding 组合，并禁用 XML 外部实体。

弱点分布

• CRLF 注入71
• HTTP 请求走私68
• Unlabeled54
• XXE38
• 资源注入35
• 违反安全设计原则（按标题归类）22
• HTTP Response Splitting20
• Externally Controlled Reference to a Resource in Another Sphere13
• LDAP 注入5
• 缓存投毒4
• Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)4
• Improper Neutralization of Escape, Meta, or Control Sequences4
• XML Injection3
• Improper Neutralization of Value Delimiters2
• XML Entity Expansion2
• Content Spoofing1
• File Content Injection1
• Improper Neutralization of Formula Elements in a CSV File1
• Improper Neutralization of Whitespace1
• Improper Output Neutralization for Logs1

共现类别

暂无共现数据。

高票报告

当前状态 350 份 · 全部 350 · 筛选赏金 $150,225

1. 2,687
   Bypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · 2019-08-08 · 高危
   $20,000HTTP 请求走私
2. 870
   Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · 2020-03-12 · 严重
   $0HTTP 请求走私
3. 685
   Stored XSS on https://paypal.com/signin via cache poisoningPayPal · 2019-08-08 · 高危
   $18,900HTTP 请求走私
4. 565
   Request smuggling on admin-official.line.me could lead to account takeoverLY Corporation · 2020-05-19 · 高危
   $0HTTP 请求走私
5. 559
   Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.comEternal · 2020-07-09 · 严重
   $0HTTP 请求走私
6. 490
   Password theft login.newrelic.com via Request SmugglingNew Relic · — · 未评级
   $3,000HTTP 请求走私
7. 439
   CRLF injectionX / xAI · 2019-12-26 · 中危
   $0Unlabeled
8. 343
   Web cache poisoning attack leads to user information and morePostmates · — · 未评级
   $500违反安全设计原则（按标题归类）
9. 341
   CRLF Injection in urllibInternet Bug Bounty · 2020-05-06 · 中危
   $1,000CRLF 注入
10. 319
    XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspxStarbucks · 2019-11-13 · 严重
    $0XXE
11. 300
    HTTP Request Smuggling via HTTP/2Basecamp · 2021-08-28 · 严重
    $7,500HTTP 请求走私
12. 300
    HTTP request SmugglingHelium · 2020-07-02 · 高危
    $0HTTP 请求走私
13. 266
    DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.comShopify · 2025-06-05 · 中危
    $3,800缓存投毒
14. 264
    XXE on pulse.mail.ruMail.ru · — · 未评级
    $6,000XXE
15. 258
    XXE on sms-be-vip.twitter.com in SXMP ProcessorX / xAI · 2017-07-27 · 中危
    $0XXE
16. 241
    HTTP request smuggling (?) canpol.deti.mail.ruMail.ru · — · 未评级
    $5,000Unlabeled
17. 218
    XXE on https://duckduckgo.comDuckDuckGo · 2019-01-31 · 严重
    $0XXE
18. 160
    HTTP Request Smuggling on https://labs.data.govGSA Bounty · 2020-05-14 · 高危
    $750HTTP 请求走私
19. 159
    Partial bypass of #483774 with Blind XXE on https://duckduckgo.comDuckDuckGo · 2019-02-26 · 高危
    $0XXE
20. 147
    Access Token Smuggling from my.playstation.com via Referer HeaderPlayStation · 2021-01-12 · 高危
    $1,000违反安全设计原则（按标题归类）
21. 147
    DMARC Not found for paragonie.com URGENTParagon Initiative Enterprises · 2016-11-03 · 严重
    $0XXE
22. 139
    HTTP Request Smuggling at app.workbox.dkVisma Public · — · 未评级
    $500HTTP 请求走私
23. 138
    XXE through injection of a payload in the XMP metadata of a JPEG fileInformatica · 2020-04-21 · 严重
    $0XXE
24. 136
    HTTP Response Header Injection in shopify/pitchfork + Rack 3Shopify · 2025-03-27 · 低危
    $800HTTP Response Splitting
25. 134
    HTTP Request Smuggling due to CR-to-Hyphen conversionNode.js · 2020-10-18 · 高危
    $0HTTP 请求走私