The Entire Internet is Broken

HTTP/1.1 request smuggling remains a critical, under-addressed vulnerability with widespread real-world impact, exposing billions of websites to severe security risks despite widespread belief it’s "fixed" 2:30-3:49.

Key Takeaways:
• HTTP/1.1’s poor request isolation allows attackers to confuse front-end and back-end servers, enabling arbitrary response manipulation, including session hijacking and cache poisoning 2:30-3:49.
• Attackers can exploit subtle header changes—like a trailing space in the Host header—to trigger desync attacks, leading to unauthorized access or data exfiltration 8:30-9:03.
• A zero CL desync attack allows prefix injection, enabling full control over victim responses, including JavaScript execution or credential theft 13:00-14:45.
• James Kettle demonstrated exploitation across major CDNs (Akamai, Cloudflare), potentially compromising over 30 million websites, with over $350,000 in bounties earned 15:09-16:02.
• The only viable long-term solution is migrating upstream connections to HTTP/2, which eliminates these flaws—backwards compatibility remains a major barrier 18:42-19:11.

The research underscores that HTTP/1.1 is fundamentally broken and that awareness, not just patching, is essential to driving industry change.

Sources:

• 2:30 Explains request smuggling, its impact, and how it breaks request isolation.
• 8:30 Details desync attacks using subtle header modifications.
• 13:00 Describes zero CL desync and its use in response poisoning.
• 15:09 Shows real-world exploitation of CDNs and financial impact.
• 18:42 Outlines the proposed solution: migrating to HTTP/2.