# H2C Smuggling in the Wild

H2C smuggling bypasses reverse proxy auth/WAF by upgrading to HTTP/2 cleartext, allowing access to restricted paths and WAF evasion on Cloudflare and Azure.

- Payout: Research
- Severity: high
- Program: Cloudflare
- Credited: Assetnote
- Disclosed: 2024-01-31
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/h2c-smuggling-in-the-wild
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-h2c-smuggling-in-the-wild
- Tags: domain:cloud impact:internal-access kind:research platform:research sev:high technique:chained vuln:auth-bypass vuln:request-smuggling

**Target:** Cloudflare CDN and Azure Application Gateway
**Root cause:** Reverse proxies stop processing individual requests after a connection upgrade, allowing HTTP/2 cleartext (H2C) to bypass routing, authentication, and WAF rules.
**Steps:**
1. Set up a backend server that accepts non-compliant H2C upgrades (only `Upgrade: h2c` header).
2. Send a request with headers `Upgrade: h2c`, `HTTP2-Settings: AAMAAABkAARAAAAAAAIAAAAA`, `Connection: Upgrade, HTTP2-Settings` to the proxy.
3. Proxy forwards the upgrade request to the backend, establishing a persistent H2C connection.
4. Send subsequent HTTP/2 requests over the same connection, bypassing proxy rules (e.g., access `/flag` or inject `<script>alert(1)</script>`).
**How found:** Followed up on Jake Miller's H2C smuggling research, tested cloud providers' load balancers with non-compliant H2C upgrades, and observed header handling differences.
**Exploitation:** Attacker sends a crafted H2C upgrade request through the proxy. Once the connection is upgraded, the proxy no longer inspects individual requests, allowing the attacker to access restricted paths or bypass WAF rules. Demonstrated on Cloudflare Access and Azure WAF.
**Escalation:** On Azure, bypassing WAF allows global WAF bypass for any request after establishing the H2C connection.
**Insight:** Test cloud load balancers for H2C upgrade support; even if a provider claims not vulnerable, non-compliant backends may still allow bypass.