Request smuggling is possible when both chunked TE and content length specified
Description
Reviewed
Jan 27, 2020
Published to the GitHub Advisory Database
Jan 27, 2020
Last updated
Jan 9, 2023
Impact
Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator.
Patches
ktorio/ktor#1547
Workarounds
None except migrating to a better proxy.
References
https://portswigger.net/web-security/request-smuggling
https://tools.ietf.org/html/rfc7230#section-9.5
References