Http 1.1 susceptible to http request smuggler

[albaropereyra22]

Hello,

I saw the following presentation at Defcon: https://http1mustdie.com and was wondering if Drogon is vulnerable.

Please advise,

[marty1885]

No for the HTTP/2 bits. Drogon in master does not support HTTP/2 so there is no smuggling to be done. In the HTTP/2 testing branch http2-beta, i saw that talk few years ago and added the needed checks.

I should be releasing a new beta for HTTP/2 soon.

For the HTTP/1.1 stuff. We support the "sane" subset of HTTP/1.1 only. So we should be fine.

[marty1885]

To be sure I ran off-the-shelf smuggling test against my own blog (Caddy as reverse proxy and Drogon server).

All clean

                  ____ _  _ _  _ ____ ____ _    _ _  _ ____                
                  [__  |\/| |  | | __ | __ |    | |\ | | __                
                  ___] |  | |__| |__] |__] |___ | | \| |__]                
                                                                           

            Author    :   Anshuman Pattnaik / @anspattnaik
            Blog      :   https://hackbotone.com/blog/http-request-smuggling-detection-tool
            Version   :   0.1
 ___________________________________________________________________________________


 [+]  Target URL  :  https://clehaxze.tw
 [+]  Method      :  POST
 [+]  Retry       :  2
 [+]  Timeout     :  10
 [+]  HRS Reports :  /home/marty/Documents/not-my-projects/http-request-smuggling/reports/clehaxze.tw

[spacejoin]      CL.TE       400         0.2s        OK          
[spacejoin]      CL.TE       400         0.18s       OK          
[spacejoin]      TE.CL       400         0.2s        OK          
[spacejoin]      TE.CL       400         0.17s       OK          
[default]        CL.TE       502         0.15s       OK          
[default]        CL.TE       502         0.17s       OK          
[default]        TE.CL       200         0.18s       OK          
[default]        TE.CL       200         0.17s       OK          
[underjoin]      CL.TE       200         0.2s        OK          
[underjoin]      CL.TE       200         0.18s       OK          
[underjoin]      TE.CL       200         0.19s       OK          
[underjoin]      TE.CL       200         0.17s       OK          
[space1]         CL.TE       502         0.17s       OK          
[space1]         CL.TE       502         0.16s       OK          
[space1]         TE.CL       200         0.19s       OK          
[space1]         TE.CL       200         0.18s       OK          
[space2]         CL.TE       502         0.18s       OK          
[space2]         CL.TE       502         0.16s       OK          
[space2]         TE.CL       200         0.19s       OK          
[space2]         TE.CL       200         0.18s       OK          
[space3]         CL.TE       400         0.18s       OK          
[space3]         CL.TE       400         0.2s        OK          
[space3]         TE.CL       400         0.2s        OK          
[space3]         TE.CL       400         0.19s       OK          
[nameprefix1]    CL.TE       400         0.19s       OK          
[nameprefix1]    CL.TE       400         0.18s       OK          
[nameprefix1]    TE.CL       400         0.17s       OK          
[nameprefix1]    TE.CL       400         0.18s       OK          
[valueprefix1]   CL.TE       502         0.17s       OK          
[valueprefix1]   CL.TE       502         0.18s       OK          
[valueprefix1]   TE.CL       200         0.18s       OK          
[valueprefix1]   TE.CL       200         0.18s       OK          
[nospace1]       CL.TE       502         0.31s       OK          
[nospace1]       CL.TE       502         0.19s       OK          
[nospace1]       TE.CL       200         0.25s       OK          
[nospace1]       TE.CL       200         0.17s       OK          
[tabprefix1]     CL.TE       502         0.19s       OK          
[tabprefix1]     CL.TE       502         0.18s       OK          
[tabprefix1]     TE.CL       200         0.2s        OK          
[tabprefix1]     TE.CL       200         0.2s        OK          
[vertprefix1]    CL.TE       400         0.17s       OK          
[vertprefix1]    CL.TE       400         0.18s       OK          
[vertprefix1]    TE.CL       400         0.17s       OK          
[vertprefix1]    TE.CL       400         0.18s       OK          
[commaCow]       CL.TE       501         0.18s       OK          
[commaCow]       CL.TE       501         0.16s       OK          
[commaCow]       TE.CL       501         0.19s       OK          
[commaCow]       TE.CL       501         0.16s       OK          
[cowComma]       CL.TE       501         0.17s       OK          
[cowComma]       CL.TE       501         0.2s        OK          
[cowComma]       TE.CL       501         0.18s       OK          
[cowComma]       TE.CL       501         0.16s       OK          
[contentEnc]     CL.TE       200         0.16s       OK          
[contentEnc]     CL.TE       200         0.19s       OK          
[contentEnc]     TE.CL       200         0.2s        OK          
[contentEnc]     TE.CL       200         0.16s       OK          
[linewrapped1]   CL.TE       400         0.18s       OK          
[linewrapped1]   CL.TE       400         0.22s       OK          
[linewrapped1]   TE.CL       400         0.16s       OK          
[linewrapped1]   TE.CL       400         0.17s       OK          
[gareth1]        CL.TE       400         0.19s       OK          
[gareth1]        CL.TE       400         0.17s       OK          
[gareth1]        TE.CL       400         0.19s       OK          
[gareth1]        TE.CL       400         0.18s       OK          
[quoted]         CL.TE       501         0.18s       OK          
[quoted]         CL.TE       501         0.19s       OK          
[quoted]         TE.CL       501         0.19s       OK          
[quoted]         TE.CL       501         0.18s       OK          
[aposed]         CL.TE       501         0.2s        OK          
[aposed]         CL.TE       501         0.18s       OK          
[aposed]         TE.CL       501         0.18s       OK          
[aposed]         TE.CL       501         0.17s       OK          
[badwrap]        CL.TE       200         0.18s       OK          
[badwrap]        CL.TE       200         0.17s       OK          
[badwrap]        TE.CL       200         0.17s       OK          
[badwrap]        TE.CL       200         0.18s       OK          
[badsetupCR]     CL.TE       400         0.18s       OK          
[badsetupCR]     CL.TE       400         0.17s       OK          
[badsetupCR]     TE.CL       400         0.17s       OK          
[badsetupCR]     TE.CL       400         0.15s       OK          
[badsetupLF]     CL.TE       502         0.18s       OK          
[badsetupLF]     CL.TE       502         0.19s       OK          
[badsetupLF]     TE.CL       200         0.18s       OK          
[badsetupLF]     TE.CL       200         0.16s       OK          
[vertwrap]       CL.TE       400         0.18s       OK          
[vertwrap]       CL.TE       400         0.18s       OK          
[vertwrap]       TE.CL       400         0.16s       OK          
[vertwrap]       TE.CL       400         0.18s       OK          
[tabwrap]        CL.TE       502         0.18s       OK          
[tabwrap]        CL.TE       502         0.18s       OK          
[tabwrap]        TE.CL       200         0.19s       OK          
[tabwrap]        TE.CL       200         0.19s       OK          
[dualchunk]      CL.TE       501         0.18s       OK          
[dualchunk]      CL.TE       501         0.18s       OK          
[dualchunk]      TE.CL       501         0.18s       OK          
[dualchunk]      TE.CL       501         0.17s       OK          
[lazygrep]       CL.TE       501         0.17s       OK          
[lazygrep]       CL.TE       501         0.16s       OK          
[lazygrep]       TE.CL       501         0.18s       OK          
[lazygrep]       TE.CL       501         0.19s       OK          
[multiCase]      CL.TE       502         0.16s       OK          
[multiCase]      CL.TE       502         0.18s       OK          
[multiCase]      TE.CL       200         0.21s       OK          
[multiCase]      TE.CL       200         0.15s       OK          
[UPPERCASE]      CL.TE       502         0.15s       OK          
[UPPERCASE]      CL.TE       502         0.23s       OK          
[UPPERCASE]      TE.CL       200         0.18s       OK          
[UPPERCASE]      TE.CL       200         0.16s       OK          
[zdwrap]         CL.TE       400         0.17s       OK          
[zdwrap]         CL.TE       400         0.19s       OK          
[zdwrap]         TE.CL       400         0.17s       OK          
[zdwrap]         TE.CL       400         0.18s       OK          
[zdsuffix1]      CL.TE       400         0.17s       OK          
[zdsuffix1]      CL.TE       400         0.18s       OK          
[zdsuffix1]      TE.CL       400         0.25s       OK          
[zdsuffix1]      TE.CL       400         0.18s       OK          
[zdsuffix2]      CL.TE       502         0.16s       OK          
[zdsuffix2]      CL.TE       502         0.18s       OK          
[zdsuffix2]      TE.CL       200         0.17s       OK          
[zdsuffix2]      TE.CL       200         0.19s       OK          
[revdualchunk]   CL.TE       501         0.16s       OK          
[revdualchunk]   CL.TE       501         0.16s       OK          
[revdualchunk]   TE.CL       501         0.15s       OK          
[revdualchunk]   TE.CL       501         0.16s       OK          
[zdspam]         CL.TE       400         0.16s       OK          
[zdspam]         CL.TE       400         0.17s       OK          
[zdspam]         TE.CL       400         0.17s       OK          
[zdspam]         TE.CL       400         0.18s       OK          
[bodysplit]      CL.TE       200         0.17s       OK          
[bodysplit]      CL.TE       200         0.17s       OK          
[bodysplit]      TE.CL       200         0.17s       OK          
[bodysplit]      TE.CL       200         0.18s       OK          
[nested]         CL.TE       501         0.18s       OK          
[nested]         CL.TE       501         0.19s       OK          
[nested]         TE.CL       501         0.2s        OK          
[nested]         TE.CL       501         0.18s       OK          
[spaceFF]        CL.TE       501         0.18s       OK          
[spaceFF]        CL.TE       501         0.18s       OK          
[spaceFF]        TE.CL       501         0.18s       OK          
[spaceFF]        TE.CL       501         0.17s       OK          
[unispace]       CL.TE       501         0.18s       OK          
[unispace]       CL.TE       501         0.17s       OK          
[unispace]       TE.CL       501         0.18s       OK          
[unispace]       TE.CL       501         0.19s       OK          
[accentTE]       CL.TE       400         0.18s       OK          
[accentTE]       CL.TE       400         0.18s       OK          
[accentTE]       TE.CL       400         0.16s       OK          
[accentTE]       TE.CL       400         0.18s       OK          
[accentCH]       CL.TE       200         0.19s       OK          
[accentCH]       CL.TE       200         0.17s       OK          
[accentCH]       TE.CL       200         0.17s       OK          
[accentCH]       TE.CL       200         0.2s        OK