We discovered a new class of attacks that affect a wide range of HTTP implementations. The problem is that deployed systems are generally incorrect (non-compliant with RFC 7230) and inconsistent in parsing and interpreting “Host” headers in HTTP requests. This problem can be exploited by carefully crafting HTTP requests with ambiguous host information, inducing inconsistent interpretations between two parties. Such inconsistency can lead to severe security consequences, such as HTTP cache poisoning and security policy bypass.
By issuring one single carefully crafted HTTP request, an attacker can:
- Poison the Squid cache of any HTTP website with arbitrary content. (Demo)
- Poison Apache Traffic Server(ATS) cache for sites hosted on Akamai. (Demo)
- Poison Akamai CDN caches when Squid resides behind Akamai.(Demo)
- Bypass Windows 8.1 filtering features. (Demo)
- Bypass cloud-based WAF without accessing the origin directly.(See our paper)
These attacks, especially the cache poisoning ones, have a significant impact in the current Internet because transparent cache proxies such as Squid and ATS are widely deployed by ISPs. We conducted large scale measurements of transparent caches on the Internet and discovered that around 97% of users served by such caches are subject to some of the cache-poisoning attacks we found.
This work was published on ACM CCS 2016. (Host of Troubles: Multiple Host Ambiguities in HTTP Implementations)
Attack Demo Videos
1. General cache poisoning attack against transparent cache(Squid)
We have demonstrated this attack for Squid-3.5.12, enabling cache poisoning of any unencrypted HTTP website. The scenario requires an attacker who can send HTTP requests that pass through a shared transparent cache(Squid 3.5.12). Note that attackers can readily obtain the necessary vantage point using techniques such as web ads. Squid has fixed this problem after our report. (You can also watch all the videos on Youtube.)
2. Exploiting co-hosting to launch attacks against transparent caches (Apache Traffic Server)
The second form exploits the situation where an attacker can obtain a web site hosted on the same server as a target web site, and the hosting server “cooperates” with a transparent cache to enable cache poisoning. Many co-hosting services such as Content Delivery Networks (CDNs) facilitate this attack. We have demonstrated this exploit on an Apache Traffic Server (ATS) 6.1.1, poisoning its cache of sites hosted on Akamai.
3. Exploiting co-hosting to launch attacks against Akamai CDN caches
The attack is different with the second form. It poisons Akamai CDN cache when a Squid proxy resides between Akamai CDN and victim’s origin server. We have demonstrated this exploit on Akamai CDN. Akamai has fixed this problem after our report.
4. Bypassing parental control features of Windows 8.1
We have demonstrated this attack by bypassing the Parental Control of Windows 8.1, a host-based firewall, by issuing the following request, which is sent to a server for “block.com”: