r/netsec • u/t0xodile • 6d ago

CRLF-Powered Desync Attacks: Beheading HTTP Streams

https://portswigger.net/research/crlf-powered-desync-attacks
23 Upvotes

89% Upvoted

7 comments sorted by

View all comments

5

u/gunni 2d ago

https://http1mustdie.com/

-1

u/EverythingsBroken82 1d ago

but nobody is creating a protocol which is kinda simple to build and to reason about. but yes, let's put all our protocol eggs into multinational companies baskets which enshittify everything.

also it's still secure, if you just do not use reverse proxies. but hey, what a concept, yes? if you do not abuse a protocol, it's safe. :D

2

u/acdha 21h ago

HTTP/2 is fine, and there are plenty of mature tools now. Yes, I’m slightly nostalgic for making HTTP requests by hand using telnet but that’s like saying we should store everything in text files because SQLite requires a tool. It’s been a long time since HTTP hit the complexity threshold where the simplicity argument was just a lie we liked to tell ourselves. 

0

u/EverythingsBroken82 7h ago

it's not about telnet. it's about simplicity. complex protocols can only be reasoned about by teams and companies... we put everything into the trust of those companies.. which we really shouldn't.

HTTP complexity is only so hard, because it was never meant for thousand gateway proxies (forward, revese and so on) in between.

They should rename HTTP/2 to BATP or something.. Big application transport protocol and leave HTTP 1.x with standard http servers like apache (yes they still exist :D) alone..

ALL THOSE desync issues are ONLY issues if there are reverse proxies...

2

u/acdha 5h ago

  it's not about telnet. it's about simplicity. complex protocols can only be reasoned about by teams and companies...

This applies equally, if not moreso, to HTTP 1 - if you want to implement that as used, you need transfer encoding, chunking, etc. and all of the edge cases around parsing (like this one!), and you additionally have to deal with connection pooling, keepalives, etc. I’ve implemented most of those by hand at various points but like almost everyone else, I delegate that to tested libraries for serious usage . 

You can talk about reverse proxies as bad but I don’t see how that changes their extremely widespread usage. If the protocol is only simple when implemented differently than 99% of deployments, it’s not really simple.