Author: CyberDudeBivash
Powered by: CyberDudeBivash Brand | cyberdudebivash.com
Related:cyberbivash.blogspot.com

CRITICAL ASP.NET VULNERABILITY: Attackers Can Smuggle HTTP Requests to Bypass Security and Poison Caches

By CyberDudeBivash · 29 Oct 2025 · cyberbivash.blogspot.com · cyberdudebivash.com

CyberDudeBivash

LinkedIn: ThreatWire cryptobivash.code.blog

Critical: New research shows that misalignment between front proxies/CDNs and ASP.NET/Kestrel/IIS backends enables HTTP request smuggling (HRS). Attackers can slip a hidden request past WAFs, bypass authentication, and poison shared caches to deliver malicious content to users at scale. Treat as an emergency.

The root problem: your edge and your app server disagree on how to parse HTTP message boundaries. With carefully crafted Content-Length/Transfer-Encoding combinations, obsolete line folding, or HTTP/2 downgrades, an attacker can smuggle a second request that your backend honors—while your security layers never see it. Below is a practical, production checklist to patch, harden, and monitor ASP.NET stacks.

TL;DR — Patch .NET & reverse proxies, enforce a single canonical parser, block dangerous TE/CL combos, disable legacy encodings, and put cache-poisoning guards on any CDN/edge. Add HRS detections to your SIEM/XDR now.

Impact: Auth bypass, cache poisoning, WAF evasion, credential/session theft.
Where: CDN/Load Balancer ↔ IIS/ASP.NET Core (Kestrel/YARP/ARR/NGINX/Envoy) boundaries.
Fix path: Update components + strict parsing + consistent connection upgrade/downgrade rules.

Contents

How HTTP Request Smuggling Hits ASP.NET

CL.TE / TE.CL: Front proxy uses one header to decide body length; backend uses the other — hidden second request rides the same connection.
Obsolete line folding / whitespace: “obs-fold” (CRLF + SP/HTAB) or non-standard spacing bypasses edge but is accepted by backend.
HTTP/2 downgrades: H/2 at edge → H/1.1 to Kestrel can reintroduce ambiguity for split/queued requests.
Desync on hop-by-hop headers: Proxies mishandle Connection, TE, Upgrade, causing parser drift.

Quick Risk Matrix: Your Stack

Higher risk if you have:

CDN/Edge (Akamai/Cloudflare/Fastly) → NGINX/Envoy/ARR/YARP → Kestrel (ASP.NET Core) or IIS.
Mixed HTTP/2 and HTTP/1.1 between hops; HTTP/3 at edge with H/1.1 to app.
Custom reverse proxy rules, legacy load balancers, or non-default request buffering settings.
Public endpoints behind shared caches (promo pages, API gateways) with Vary misconfigurations.

Immediate Fix (Do This Now)

Patch everything: Update .NET/.NET Core, Kestrel, IIS (cumulative updates), YARP/ARR/NGINX/Envoy, and your CDN security rules.
Single source of truth: Terminate HTTP/2/3 at the edge; speak a single protocol (H/1.1) downstream or keep H/2 end-to-end consistently. Avoid mixed hops.
Block ambiguous requests: On edge & reverse proxy: reject requests with both Content-Length and Transfer-Encoding; drop multiple TE headers; disallow chunked to backends that don’t expect it.
Normalize headers: Strip hop-by-hop headers at the edge (Connection, TE, Keep-Alive, Upgrade), collapse whitespace, and ban obs-fold.
Kestrel/IIS guards: Set tight MaxRequestBodySize, RequestHeadersTimeout, and RequestHeaderEncodingSelector; enable request buffering only when needed; prefer DisableHttp1LineFolding equivalents where available.
Auth at the edge: For sensitive paths, force end-to-end re-auth (no cache) and validate anti-CSRF tokens on state-changing routes.

Detections & Hunt Queries

WAF/Edge logs: 4xx spikes on mixed CL/TE, multiple TE, or duplicate Content-Length headers.
Reverse proxy: upstream disconnects, HTTP/2 → 1.1 downgrade anomalies, unusual keep-alive reuse with different users.
App logs: state-changing POSTs without CSRF tokens; authenticated routes from unauth’d clients; cache HITs for personalized pages.
SIEM/XDR: User switches mid-connection; multiple identities over one TCP socket; sudden cache HIT ratio changes.

Cache Poisoning Defences

Set Cache-Control: no-store on authenticated/personalized responses; never cache cookies or session-bound pages.
Normalize Host, X-Forwarded-Proto, X-Forwarded-Host at the edge; strip untrusted variants.
Use strict Vary only on headers you control (e.g., Accept-Encoding); avoid Vary: *.
For CDNs: enable “origin shield” normalization and request coalescing; block cache writes from ambiguous requests.

Long-Term Hardening Checklist

Adopt a request desync test in CI/CD (security integration tests against lower envs).
Keep protocol consistent per app: e2e H/2 or standardized H/1.1; document hop-by-hop behavior.
Use YARP/NGINX/Envoy with strict parsing and body buffering for state-changing routes only.
Sign/validate cookies; enforce SameSite=Lax/Strict and HttpOnly/Secure flags.
Run blue/green for proxy rule changes; measure latency, 4xx/5xx, cache hit ratio after each change.

Recommended by CyberDudeBivash (Partner Links)

Patch fast, detect faster, upskill your team:

Kaspersky EDR/XDR
Spot anomalous sessions & cache-poison indicators Edureka — Web/AppSec for .NET
Hands-on HRS & reverse-proxy hardening TurboVPN
Secure admin access during hotfixes

Alibaba Cloud (Global)
Spin up staging edges to test H/2→H/1.1 downgrades AliExpress (Global)
Hardware keys & lab gear for red-teaming Rewardful
Run a secure partner program for your SaaS

CyberDudeBivash Services & Apps

Need help now? We deliver .NET edge hardening, cache-poisoning prevention, WAF tuning, and 24×7 incident response.

PhishRadar AI — detects malicious agent traffic & anomalous requests
SessionShield — protects tokens, cookies & session boundaries
Threat Analyser GUI — dashboards + log correlation for HRS hunts

Explore Apps & Products Book an ASP.NET Edge Hardening Sprint Subscribe to ThreatWire

FAQ

Q: We use Cloudflare/Akamai/Fastly — are we safe?
A: Safer, not immune. You must align edge rules with backend parsing and block ambiguous requests everywhere.

Q: Does this only affect HTTP/1.1?
A: No. H/2→H/1.1 downgrades can reintroduce ambiguity; keep protocol consistent or terminate at the edge with strict normalization.

Q: Is this a WAF-only problem?
A: No. WAFs can miss smuggled payloads if the backend honors them. Fix at architecture + app layers.

Next Reads

Affiliate Disclosure: We may earn commissions from partner links at no extra cost to you. Opinions are independent.

CyberDudeBivash — Global Cybersecurity Apps, Services & Threat Intelligence.

cyberbivash.blogspot.com · cyberdudebivash.com · cryptobivash.code.blog

#CyberDudeBivash #ASPNet #RequestSmuggling #CachePoisoning #DotNet #WAF #ReverseProxy #ThreatWire

Cyberdudebivash