HTTP 1.1 Must Die! The Desync Endgame

HTTP/1.1 Must Die: The Desync Endgame

Speakers: James Kettle

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=PUCyExOr3sE

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/James%20Kettle%20-%20HTTP1.1%20Must%20Die%21%20The%20Desync%20Endgame.pdf

Overview

James Kettle's fourth annual DEF CON session on HTTP desync attacks represents both the culmination of a multi-year research program and a sobering conclusion: the attack class has not been resolved, has become more dangerous, and will not be eliminated until HTTP/1.1 is fully retired from inter-server communication. The talk introduces new attack primitives — including "request smuggling via HTTP/2" (H2.TE) and a technique called "server-side pause-based desync" — and demonstrates that the migration to HTTP/2 has not mitigated desync at all; it has in many cases made the threat worse. Kettle calls for the industry to commit to HTTP/2 end-to-end, retiring HTTP/1.1 as the inter-server protocol, and frames this as the only durable solution to the class.

Background

▶ Watch: Case study origin: HTTP desync over PayPal's login page, twice (2:13)

Kettle introduced HTTP desync research in 2019 with the observation that HTTP/1.1 has a fundamental structural flaw: there is no reliable way for a parser to determine exactly where one request ends and the next begins. Two header fields — Content-Length and Transfer-Encoding: chunked — can be used to specify message body length, and when a front-end proxy and a back-end server disagree on which one takes precedence, the front-end's view of request boundaries differs from the back-end's. An attacker who can engineer this disagreement can smuggle a prefix of a second request into the first, causing the back-end to treat it as the beginning of the next request. This enables a wide range of attacks: persistent cookie injection into other users' responses, login CSRF, cache poisoning, and full site takeover depending on the target architecture.

At the time, the recommended fix was to deploy HTTP/2 for the front-end-to-back-end connection (upstream), which eliminates ambiguity because HTTP/2 frames have explicit length fields. Six years later, the speaker observed: "We didn't do that." The industry adopted HTTP/2 for client-to-front-end connections, but most servers still downgrade that to HTTP/1.1 for the upstream connection.

Key Findings

▶ Watch: Research journey: 6 years evolving from H1 desync to H2 desync attacks (11:19)

• H2 downgrade attacks (H2.TE / H2.CL): When a front-end server accepts HTTP/2 from clients but converts to HTTP/1.1 for upstream, it must translate HTTP/2 requests into HTTP/1.1. If the conversion is imperfect — for example, if attacker-controlled HTTP/2 headers become HTTP/1.1 headers in ways that introduce TE/CL ambiguity — a desync is achievable via what the speaker terms "H2.TE" and "H2.CL" attacks. This means migrating to HTTP/2 for the client connection without fixing the upstream actually creates new attack vectors.

• Server-side pause-based desync: A new class of desync attack that does not require any CL/TE ambiguity. Instead, it exploits the fact that some back-end servers will accept a partial HTTP/1.1 request and hold the connection open waiting for the body. By engineering a pause in a front-end proxy, an attacker can cause the front-end to reassign the waiting back-end connection to a different client's request, which is then prepended with the attacker's partial prefix.

• Client-side desync: In some architectures, the attacker does not need to interact with a shared back-end connection at all. They can trigger a desync from a victim's browser by exploiting CORS or service worker behaviors that cause the browser to send attacker-influenced requests.

• Widespread deployments remain vulnerable. The speaker surveyed major CDN and load balancer products and found that the majority still have some desync-inducing configuration or default behavior. Several major platforms were vulnerable at time of research.

• PayPal was exploited twice using request smuggling to gain persistent control over the login page — a fact the speaker cited as an illustration of both the impact and the durability of the attack class.

Technical Deep Dive

▶ Watch: Tool release: automated scanner finds desync vulnerabilities at scale (15:43)

Classic CL.TE desync: A request is sent with both a Content-Length header and a Transfer-Encoding: chunked header. The front-end uses Content-Length and forwards the whole payload to the back-end. The back-end uses Transfer-Encoding, reads a chunk of the body, and considers the rest as the beginning of a new request. The attacker's "new request prefix" is now prepended to the next legitimate user's request reaching that back-end connection.

H2.TE attack mechanics: HTTP/2 does not have a TE header at the protocol level, but front-ends may preserve HTTP/2 pseudo-headers or arbitrary headers when converting to HTTP/1.1. If an attacker sends an HTTP/2 request with a crafted transfer-encoding: chunked header that survives conversion, and the back-end honors it while the front-end's HTTP/2-to-HTTP/1.1 conversion logic does not account for it in determining body size, a desync results. The precise feasibility depends on how the conversion layer handles header fields.

Server-side pause-based desync (new technique): This attack exploits connection reuse in back-end connection pools. The scenario:

1. Attacker sends a request with a body that is exactly one byte short of what Content-Length specifies.
2. The back-end reads the incomplete body and waits for the final byte, keeping the connection open.
3. The front-end, after some timeout or based on the response header, hands this waiting connection back to the pool.
4. A victim's request is assigned the same back-end connection.
5. The first byte of the victim's request (or more, depending on read buffering) becomes the "missing byte" of the attacker's request body, and the remainder of the victim's request is now processed as a new request with attacker-controlled prefix bytes already in the back-end's buffer.

Turbo intruder and tooling: The speaker's research relies heavily on precise timing control for sending requests. He described updates to the Turbo Intruder Burp Suite extension to support pause-based desync detection and exploitation, including the ability to send a request body in two separate TCP segments with a controlled delay.

Impact assessment: The severity of desync vulnerabilities depends heavily on architecture. In single-server deployments, impact is minimal. In multi-server deployments where a front-end serves many users' requests to a pool of shared back-end connections, a successful desync can affect any user whose request happens to be assigned the poisoned connection.

Demo / Proof of Concept

▶ Watch: Windows device name trick: OS-reserved filenames create universal desync (20:18)

Kettle demonstrated:

• A live pause-based desync attack against a real (anonymized or representative) target, showing the attacker's request prefix being prepended to a victim's request.
• H2.TE exploitation on a major CDN configuration, showing how the HTTP/2 client connection combined with HTTP/1.1 upstream creates new desync surface.
• The PayPal vulnerability was described in detail as a case study of maximum-impact desync exploitation: persistent control over the login page, meaning every user visiting PayPal's login received an attacker-controlled response until the cache was cleared.

Tools released: Updated Turbo Intruder with pause-based desync features, HTTP/2 desync test cases.

Defensive Implications

▶ Watch: Live demo: chaining desync with input reflection to expose headers/secrets (24:48)

The only complete fix is retiring HTTP/1.1 upstream. The speaker's core conclusion is that as long as HTTP/1.1 is used for server-to-server communication, the attack surface exists. Organizations serious about eliminating request smuggling should migrate their back-end connections to HTTP/2.

Where HTTP/1.1 upstream is unavoidable:

• Enforce strict enforcement of one of CL or TE, rejecting requests that include both — with the same preference on both front-end and back-end.
• Configure front-ends to normalize incoming requests before forwarding: strip conflicting headers, canonicalize chunk encoding, reject requests where body length is ambiguous.
• Use persistent connection draining after suspicious requests rather than immediately reusing connections.

Detect desync attempts: Requests containing both Content-Length and Transfer-Encoding headers (especially obfuscated variants of TE, like Transfer-Encoding: identity, chunked) should be logged and alerted on. These rarely appear in legitimate traffic.

Test your infrastructure: The Burp Suite HTTP Desync Auditor extension and the updated Turbo Intruder provide practical tools to test whether a given architecture is vulnerable.

Review CDN and load balancer configurations. Default configurations of several major products were shown to be vulnerable. Consult vendor guidance and test explicitly.

Key Takeaways

1. Six years of awareness of HTTP desync attacks has not eliminated them; the threat has expanded as new attack variants exploiting HTTP/2-to-HTTP/1.1 downgrade were discovered.
2. The "H2 everywhere" recommendation has been implemented only half-way: H2 client-to-front-end is now common, but H2 front-end-to-back-end is not, and this halfway state creates new attack vectors.
3. Server-side pause-based desync is a new technique that does not require CL/TE header ambiguity, expanding the conditions under which desync is achievable.
4. The most impactful desync attacks enable persistent injection into all users' responses, representing a full site takeover primitive.
5. The only durable solution is retiring HTTP/1.1 for server-to-server communication entirely — hence the talk title "HTTP/1.1 Must Die."
6. Updated tooling in Turbo Intruder enables practitioners to test for these new variants.

About the Speaker(s)

▶ Watch: Responsible disclosure failure: vendor deleted bug bounty program instead of ... (29:12)

James Kettle is the Director of Research at PortSwigger (the makers of Burp Suite). He is the originator of HTTP desync attack research as a systematic field and has presented on this topic at DEF CON annually since 2019. His earlier research also established web cache poisoning and HTTP request tunneling as distinct attack classes. He is one of the most cited researchers in the web application security field.