What does "connection" mean in context of request smuggling

Question

I recently read about request smuggling. This is a very interesting attack that I didn't know about. A vulnerability to this was recently discovered at Slack, disclosed responsibly and a bounty was awarded.

The linked article says:

When the front-end server forwards HTTP requests to a back-end server, it typically sends several requests over the same back-end network.

Request smuggling uses the fact that multiple requests go over one connection.

My question is: What is this connection? I'm a newbie at networking. I know that there are multiple layers to a connection: IP, TCP, SSL. Can you please explain what is the layer at which this connection exists?

Update: If someone could include an example, preferably in Python, of how one would send multiple requests on the same connection, that'd be helpful.

Answer 1

This is about a TCP connection (both with and without TLS). With HTTP keep-alive multiple HTTP requests can be send one after each other inside the same TCP connection and it is up to the HTTP stack to properly distinguish where a request starts and where it ends.

Due to the complexity and in some cases ambiguity of the HTTP standard it is possible to create sequences of HTTP requests where different HTTP stacks (i.e. in front-end and back-end servers) have different ideas where a request starts end ends. These interpretation differences allow HTTP request smuggling.

Answer 2

Just a complement to @steffen Ulrich response which is right.

The HTTP/HTTPS protocol is base on a TCP/IP connection. Once established the TCP/IP connexion could be used for just on round-trip of HTTP request and response, but can also be kept open (keepalive mode). The fact that the connection is kept alive is controlled by both sides (the HTTP client and server), the server can close it at any time (usually sending a Connection:close header to tell the client it will be closed), and the client can also close it at any time.

HTTP/1.1 introduced another layer on top of the Keepalive mechanism, which is HTTP Pipelining. Where you can send several requests on the TCP/IP connection, not waiting for the response between each response, and this is a key component in smuggling attacks because you can use that to hide several requests and obtain several responses, while some of the actors in the chain see only one request incoming.

Yes, because they are more actors than just the client and server. To make some smuggling issues you need to have a chain of actors (load balancers, reverse proxy caches) which acts as proxies. They receive the HTTP request from the client (via a tcp/ip connection), establish a tcp/ip connection to a backend (and potentially store that connection in a local pool), and forward the request to a backend (acting as the HTTP client for this backend). So if you track all the connections you do not just have one, but several steps of connections between actors. A Smuggling attacks needs to target one of these actors, where the number of requests or responses generated will differ from the previous actors.

Now if you want examples of writing seevral queries you could do that with sending text in a socket in python, or even in bash with printf for the text and nc for the socket (or openssl-s_client if its on https).

I wrote once an example with echo and telnet... yes, here: https://stackoverflow.com/questions/19619124/http-pipelining-request-text-example/19621514#19621514 So the connection is managed by telnet (but nc or netcat is usually better), and the http protocol by yourself, for the client part.

Andif you wander what is an HTTPS connection, it is also a tcp/ip connection, with the HTTP protocol used inside for requests and responses messages. But just between these two layers (tcp/ip & http) another one is added (ssl or TLS) with some messages exchanged between the actors to choose the right of encrypting the communication. That layers obfuscate the HTTP messages for anyone reading the tcp/ip streams, but for the client and server the text content of the HTTp protocol is extracted from the layer and it's just plain HTTP. So Smuggling attacks are usually not impacted by HTTPS.