# HTTP Request Smuggling / HTTP/2 Desync

> CL.TE / TE.CL / TE.TE / HTTP/2 pseudo-header confusion / Frontend-backend parsing discrepancies

## High-Risk Areas
- Frontend proxy and backend server have inconsistent parsing of Content-Length / Transfer-Encoding (CL.TE / TE.CL / TE.TE)
- Header normalization discrepancies during HTTP/2 to HTTP/1 conversion (`Host` / `:authority` / duplicate headers)
- Prefix/suffix path tricks, dual Content-Length, forged chunked encoding
- Inconsistent handling of duplicate Host/X-Forwarded-Host leading to cache/route poisoning

## Detection Commands/Approach
- Configuration audit: Check if Nginx/Envoy/Apache disables invalid combinations (`ignore_invalid_headers on`, strict chunk validation, disallow multiple CL)
- Logs/proxies: Check for H2 to H1 protocol conversion; check if HTTP/2 cleartext (h2c) is enabled without source restrictions
- Code audit: Check for custom parsing of `Content-Length`/`Transfer-Encoding`; check if values from downstream/upstream are trusted

## Minimal PoC (Requires Test Environment)
```bash
# CL.TE
printf 'POST / HTTP/1.1\r\nHost: victim\r\nContent-Length: 48\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nG' | nc victim 80

# Dual Content-Length
printf 'POST / HTTP/1.1\r\nHost: victim\r\nContent-Length: 4\r\nContent-Length: 1\r\n\r\nG' | nc victim 80

# HTTP/2 forged pseudo-header (requires h2c/h2)
h2csmuggler -u https://victim/ --path /admin
```

## Protection Baseline
- Gateway/reverse proxy: Disable/drop mixed CL/TE; disallow multiple Content-Length; disable h2c; strict header normalization; restrict duplicate Host/XFH
- Application: Do not parse CL/TE manually; whitelist absolute paths, Host, and scheme; do not trust downstream/upstream rewritten routes/Host
- Log monitoring: Alert on abnormal HTTP status codes, chunk errors, and illegal headers
