Summary
A client-side desync vulnerability was discovered in Front Door, one of Azure's CDN solutions,
caused by mishandling of the 'Content-Length' header in HTTP requests. Exploiting this vulnerability
would most likely require user interaction through social engineering (such as clicking on a malicious
link), but could allow an attacker to steal session cookies or forge responses to victim requests.
Affected Services
Azure Front Door
Remediation
null
Tracked CVEs
No tracked CVEs
References
https://blog.jeti.pw/posts/knocking-on-the-front-door/https://portswigger.net/research/browser-powered-desync-attacks
Contributed by https://github.com/mer-b
Entry Status
Finalized
Disclosure Date
Mon, May 8th, 2023
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Jeti
