GET request in the body of GET request

Question

I'm testing some API endpoints aaand with some arbitrary crazy tests, like:

GET /products/items HTTP/1.1
Host: api.companysite.com
Content-Type: application/xml
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.12 (KHTML, like Gecko) Maxthon/3.0 Chrome/26.0.1410.43 Safari/535.12
Connection: keep-alive
Content-Length: 47

GET /robots.txt HTTP/1.1
Host: app.companysite.com

Where that GET /robots HTTP/1.1 part is in body of GET /products/items request, I received the craziest response:

HTTP/1.1 400 Bad Request
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Content-Type: application/json; charset=UTF-8
Expires: 0
Last-Modified: 2019-09-19 07:19:08.998002474 +0000 UTC
Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
Vary: Origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Length: 71
Date: Thu, 19 Sep 2019 07:19:09 GMT
Connection: keep-alive

{"status":"ERROR","message":"No Authorization header","code":"AUTH01"}
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Thu, 12 Sep 2019 09:37:21 GMT
ETag: "5d7a11d1-36"
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
CF-Visitor: {scheme:https}
Cache-Control: max-age=1066261
Expires: Tue, 01 Oct 2019 15:30:10 GMT
Date: Thu, 19 Sep 2019 07:19:09 GMT
Content-Length: 54
Connection: keep-alive

User-agent: *
Sitemap: https://app.companysite.com/sitemap.xml

I know this gives a 400 response code because of the body in the GET request, but what about that second part of this response? Why Am I able to send two different requests using one GET request? It is not the request smuggling attack, there are no CL.TE, TE.CE, TE.TE headers and obviously there are no POST requests. What is going on over there, what do you think?

Answer 1

When you see multiple HTTP request on the same TCP segment, in general this is called 'HTTP pipelining'

By using pipelining, you can put multiple methods on one request from the client side: https://en.wikipedia.org/wiki/HTTP_pipelining

Answer 2

As @camp0 said, it's http pipelining. Now days used by load balancers, cns, firewalls, etc.. to communicate to back-end systems. For the sake of resources, time and cost, one tcp connection is used to send multiple http requests.

A request life cycle can be rich. And in most modern web apps it is. When you send a request it may go trough server which serves as the analytic system, then trough a firewall, then the actual application server. I'm just making this specific route up, but I hope you get the point. Those servers forward requests trough a small pool of connections, it's cheaper and faster that way.

Yes, old vulnerabilities are becoming trendy because of a change in how we create applications. But that is normal. And always will be.