# How an Akamai misconfiguration earned us USD 46.000

Akamai CDN accepted `Connection: Content-Length` header, enabling request smuggling and cache poisoning to serve arbitrary hosts' content under victim URLs.

- Payout: $46,000
- Severity: high
- Program: Akamai, Microsoft, Apple
- Credited: Francesco Mariani, Jacopo Tediosi
- Disclosed: 2022-09-17
- Write-up quality: 7/10
- Original: https://blog.hacktivesecurity.com/index.php/2022/09/17/http/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-hacktivesecurity-com-index-php-2022-09-17-http
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:high tech:cdn technique:chained technique:recon vuln:cache-poisoning vuln:request-smuggling

**Target:** Akamai CDN edge/proxy HTTP request handling
**Root cause:** Akamai's proxy honored a `Connection: Content-Length` header, causing front-end and back-end to disagree on request framing (desync) between hop-by-hop and end-to-end parsing.
**Steps:**
1. Send `OPTIONS /random.txt HTTP/1.1` with `Host: ORIGINAL-HOST`, `Connection: Content-Length`, `Content-Length: 42`, then a smuggled `GET /robots.txt HTTP/1.1` with `Host: ARBITRARY-AKAMAI-HOST` and `x: 1`
2. Send the request twice so the smuggled response gets cached under the first URL
3. Visit `/it/it/medusa.txt` to retrieve the second host's robots.txt, confirming cache poisoning
**How found:** Noticed unusual Akamai responses like `[no URL]` and differing responses when manipulating the `Connection` header; attempts with `Connection: Content-Length` initially failed, but redirecting requests between hosts revealed an open desync, then cache poisoning was discovered by testing static-extension paths.
**Exploitation:** Attacker sends a crafted OPTIONS/GET request with `Connection: Content-Length` to a nonexistent static path on a victim Akamai host, smuggling a second request to an arbitrary Akamai host; the second host's response is cached under the victim URL, letting the attacker serve arbitrary content (HTML/JS) from the victim's origin.
**Escalation:** Chained desync into cache poisoning to convert a DoS-only primitive into arbitrary content injection on victim origins; used OPTIONS to evade Akamai detection.
**Insight:** When a CDN returns odd placeholder responses or behaves inconsistently on `Connection`/`Content-Length` manipulation, test cross-host desync by smuggling a request to a different host in the same CDN and check whether the second response gets cached under the first URL.