Security researchers identify new CRLF-powered HTTP desync attacks

Security researchers from PortSwigger and TurtleSec have identified a new category of HTTP request smuggling known as “CRLF-Powered Desync Attacks.” This vulnerability exploits misconfigurations in front-end servers, specifically Nginx deployments where the $uri variable is included directly in the proxy_pass directive. In these cases, Nginx may URL-decode the request path, converting encoded carriage return and line feed characters (%0d%0a) into actual newlines before forwarding the request to the backend.

This injection allows attackers to manipulate the structure of upstream HTTP requests, leading to several critical security risks. These include Response Queue Poisoning (RQP), where a server loses track of which response belongs to which client, potentially delivering one user's sensitive data or session cookies to another. The researchers demonstrated that this can affect shared CDN infrastructure, risking the exposure of authentication tokens for thousands of unrelated applications hosted on the same platform.

Beyond data theft, the attack can be used to poison CDN caches and deliver Cross-Site Scripting (XSS) payloads to legitimate users. The researchers also demonstrated the ability to create self-propagating desync worms and bypass traditional defenses using sophisticated Content-Length/Transfer-Encoding (CL.TE) desynchronization techniques.