Upgrade Header Smuggling
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
H2C, या http2 over cleartext, अस्थायी HTTP कनेक्शनों के मानक से भटकता है, एक मानक HTTP कनेक्शन को स्थायी में अपग्रेड करके। यह अपग्रेड किया गया कनेक्शन ongoing संचार के लिए http2 बाइनरी प्रोटोकॉल का उपयोग करता है, जो कि plaintext HTTP की एकल-निवेदन प्रकृति के विपरीत है।
स्मगलिंग समस्या का मुख्य कारण रिवर्स प्रॉक्सी के उपयोग में है। सामान्यतः, रिवर्स प्रॉक्सी HTTP अनुरोधों को प्रोसेस और फॉरवर्ड करता है, उसके बाद बैकएंड का उत्तर लौटाता है। हालाँकि, जब HTTP अनुरोध में Connection: Upgrade हेडर मौजूद होता है (जो सामान्यतः वेबस्केट कनेक्शनों के साथ देखा जाता है), तो रिवर्स प्रॉक्सी क्लाइंट और सर्वर के बीच एक स्थायी कनेक्शन बनाए रखता है, जो कुछ प्रोटोकॉल द्वारा आवश्यक निरंतर विनिमय को सुविधाजनक बनाता है। H2C कनेक्शनों के लिए, RFC का पालन करने के लिए तीन विशिष्ट हेडरों की उपस्थिति आवश्यक है:
The vulnerability arises when, after upgrading a connection, the reverse proxy ceases to manage individual requests, assuming its job of routing is complete post-connection establishment. Exploiting H2C Smuggling allows for circumvention of reverse proxy rules applied during request processing, such as path-based routing, authentication, and WAF processing, assuming an H2C connection is successfully initiated.
The vulnerability is contingent on the reverse proxy's handling of Upgrade and sometimes Connection headers. The following proxies inherently forward these headers during proxy-pass, thereby inherently enabling H2C smuggling:
HAProxy
Traefik
Nuster
Conversely, these services do not inherently forward both headers during proxy-pass. However, they may be configured insecurely, allowing unfiltered forwarding of Upgrade and Connection headers:
AWS ALB/CLB
NGINX
Apache
Squid
Varnish
Kong
Envoy
Apache Traffic Server
It's crucial to note that not all servers inherently forward the headers required for a compliant H2C connection upgrade. As such, servers like AWS ALB/CLB, NGINX, and Apache Traffic Server, among others, naturally block H2C connections. Nonetheless, it's worth testing with the non-compliant Connection: Upgrade variant, which excludes the HTTP2-Settings value from the Connection header, as some backends may not conform to the standards.
Irrespective of the specific path designated in the proxy_pass URL (e.g., http://backend:9999/socket.io), the established connection defaults to http://backend:9999. This allows for interaction with any path within that internal endpoint, leveraging this technique. Consequently, the specification of a path in the proxy_pass URL does not restrict access.
The tools h2csmuggler by BishopFox and h2csmuggler by assetnote facilitate attempts to circumvent proxy-imposed protections by establishing an H2C connection, thereby enabling access to resources shielded by the proxy.
For additional information on this vulnerability, particularly concerning NGINX, refer to this detailed resource.
Websocket smuggling, unlike creating a HTTP2 tunnel to an endpoint accessible via a proxy, establishes a Websocket tunnel to bypass potential proxy limitations and facilitate direct communication with the endpoint.
In this scenario, a backend that offers a public WebSocket API alongside an inaccessible internal REST API is targeted by a malicious client seeking access to the internal REST API. The attack unfolds in several steps:
The client initiates by sending an Upgrade request to the reverse proxy with an incorrect Sec-WebSocket-Version protocol version in the header. The proxy, failing to validate the Sec-WebSocket-Version header, believes the Upgrade request to be valid and forwards it to the backend.
The backend responds with a status code 426, indicating the incorrect protocol version in the Sec-WebSocket-Version header. The reverse proxy, overlooking the backend's response status, assumes readiness for WebSocket communication and relays the response to the client.
Consequently, the reverse proxy is misled into believing a WebSocket connection has been established between the client and backend, while in reality, the backend had rejected the Upgrade request. Despite this, the proxy maintains an open TCP or TLS connection between the client and backend, allowing the client unrestricted access to the private REST API through this connection.
Affected reverse proxies include Varnish, which declined to address the issue, and Envoy proxy version 1.8.0 or older, with later versions having altered the upgrade mechanism. Other proxies may also be susceptible.
This scenario involves a backend with both a public WebSocket API and a public REST API for health checking, along with an inaccessible internal REST API. The attack, more complex, involves the following steps:
The client sends a POST request to trigger the health check API, including an additional HTTP header Upgrade: websocket. NGINX, serving as the reverse proxy, interprets this as a standard Upgrade request based solely on the Upgrade header, neglecting the request's other aspects, and forwards it to the backend.
The backend executes the health check API, reaching out to an external resource controlled by the attacker that returns a HTTP response with status code 101. This response, once received by the backend and forwarded to NGINX, deceives the proxy into thinking a WebSocket connection has been established due to its validation of only the status code.
Warning: This technique's complexity increases as it requires the ability to interact with an endpoint capable of returning a status code 101.
Ultimately, NGINX is tricked into believing a WebSocket connection exists between the client and the backend. In reality, no such connection exists; the health check REST API was the target. Nevertheless, the reverse proxy maintains the connection open, enabling the client to access the private REST API through it.
Most reverse proxies are vulnerable to this scenario, but exploitation is contingent upon the presence of an external SSRF vulnerability, typically regarded as a low-severity issue.
Check the labs to test both scenarios in https://github.com/0ang3el/websocket-smuggle.git
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
