PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Making HTTP header injection critical via response queue poisoning

portswigger.net | research | #bug-bounty | #web-security | #proxy | #http-request-smuggling | #response-queue-poisoning | #header-injection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How a path-based header injection was upgraded into critical response queue poisoning: injecting Connection: keep-alive and a smuggled request poisons other users' responses, earning a $12,500 bounty.
Published
Collected

Related coverage

vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · portswigger.net
JSON hijacking for the modern web
Gareth Heyes revives cross-domain JSON hijacking with JS proxies that capture undefined variables, plus an Edge bypass via Object.setPrototypeOf. A UTF-16BE charset trick makes JSON arrays stealable.
research · portswigger.net
Breaking the chains on HTTP Request Smuggler
James Kettle details a major update to the HTTP Request Smuggler Burp extension, adding an automated confirmation stage and improved accuracy to keep pace with patched targets.
research · portswigger.net
Attacking and defending JavaScript sandboxes
Attacking and defending JavaScript sandboxes: with-statement breakouts, prototype tampering and generator constructors defeat naive proxy sandboxes; checkSyntax and a hardened design are proposed.
Back