CME-912

HTTP Header Normalization and Request Smuggling Prevention

Harden Application Unquantified evidence Preventive

Description

Enforce strict HTTP header parsing on all HTTP intermediaries (proxies, load balancers, reverse proxies, web servers) to prevent request smuggling via header desynchronization. The control requires: (1) rejecting requests containing both Content-Length and Transfer-Encoding headers per RFC 7230 Section 3.3.3, (2) rejecting requests with duplicate Content-Length headers carrying differing values, (3) disabling relaxed header parsing modes that tolerate whitespace or encoding variations in Transfer-Encoding values, and (4) normalizing or rejecting header values containing illegal characters (bare CR, bare LF, NUL bytes). These measures eliminate the primary desynchronization vectors that enable an attacker to inject smuggled requests across the proxy-backend boundary.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Strict header normalization closes the standard CL/TE and duplicate-CL desync vectors, forcing the attacker to discover novel parser-specific bypass techniques to achieve smuggling
Integrity (I)	H → L	Preventing request smuggling eliminates the primary integrity impact: cache poisoning and request injection into other users sessions

CWE Relationships

CWE-444 CWE-113 CWE-436

Verification

Verify that HTTP intermediaries enforce strict header parsing: reject requests with both Content-Length and Transfer-Encoding, reject duplicate Content-Length headers, and disable relaxed parsing modes

$ grep -i 'relaxed_header_parser' /etc/squid/squid.conf
# Expected: off

Platform: linux

$ grep 'http-request deny.*hdr_cnt(content-length)' /etc/haproxy/haproxy.cfg
# Expected: http-request deny

Platform: linux

$ grep -i 'HttpProtocolOptions' /etc/httpd/conf/httpd.conf
# Expected: Strict

Platform: linux

$ grep -i 'proxy_http_version' /etc/nginx/nginx.conf /etc/nginx/conf.d/*.conf 2>/dev/null
# Expected: 1.1

Platform: linux

$ Get-WebConfigurationProperty -Filter 'system.webServer/security/requestFiltering' -PSPath 'IIS:\' -Name allowDoubleEscaping
# Expected: False

Platform: windows

Remediation

linux nginx strict HTTP parsing and smuggling prevention


printf 'proxy_http_version 1.1;\nunderscores_in_headers off;\nlarge_client_header_buffers 4 8k;\nignore_invalid_headers on;\n' > /etc/nginx/conf.d/cme-912-smuggling-prevention.conf
nginx -t
systemctl reload nginx

linux Apache httpd HttpProtocolOptions Strict enforcement


printf 'HttpProtocolOptions Strict\n' > /etc/httpd/conf.d/cme-912-strict-protocol.conf
apachectl configtest
systemctl reload httpd

linux HAProxy duplicate Content-Length denial and strict parsing


printf '\n# CME-912: Request smuggling prevention\nhttp-request deny if { hdr_cnt(content-length) gt 1 }\nhttp-request deny if { hdr(transfer-encoding) -m found } { hdr(content-length) -m found }\noption httpclose\n' >> /etc/haproxy/haproxy.cfg
haproxy -c -f /etc/haproxy/haproxy.cfg
systemctl reload haproxy

windows IIS request filtering with double-encoding and high-bit character rejection


Set-WebConfigurationProperty -Filter 'system.webServer/security/requestFiltering' -PSPath 'IIS:\' -Name allowDoubleEscaping -Value $false
Set-WebConfigurationProperty -Filter 'system.webServer/security/requestFiltering' -PSPath 'IIS:\' -Name allowHighBitCharacters -Value $false