# HTTP Desync Attack (Request Smuggling) - Mass Account Takeover at a Cryptocurrency based asset and 121 other websites

CL.TE request smuggling in Distil bot-protection front-end let attacker log other users' requests (cookies, reset tokens) via a saved form field, enabling mass account takeover across 122 hosts.

- Payout: $4,300
- Severity: critical
- Program: -
- Credited: Ankit Singh
- Disclosed: 2022-09-14
- Write-up quality: 8/10
- Original: https://github.com/AnkitCuriosity/Write-Ups/blob/main/HTTP%20Desync%20Attack%20(Request%20Smuggling).md
- Library page: https://bugbountylibrary.com/r/blog%3Agithub-com-ankitcuriosity-write-ups-blob-main-http-20desync-20attack-20-request-20smuggling-md
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:critical tech:cdn technique:chained vuln:info-disclosure vuln:request-smuggling

**Target:** HTTP front-end/back-end (Distil bot manager) with urlencoded form field
**Root cause:** Front-end uses Content-Length while back-end honors Transfer-Encoding (with dual chunked/identity headers), desynchronizing request boundaries so the next user's request is appended to the attacker's smuggled POST body.
**Steps:**
1. Send ambiguous request with `Content-Length: 46`, `Transfer-Encoding: chunked`, `Transfer-encoding: identity`, body `0\r\n\r\nPOST /user/vendor/legal ...` ending with `user_vendor_legal%5Baddress%5D=`
2. Victim browses my.vulnerable.com normally; their next request gets appended as the value of the address param
3. Attacker visits /user/vendor/legal and reads the logged victim request (cookies, X-D-Token, reset tokens)
4. Repeat to harvest mass requests; same backend IP 192.225.xxx.x serves 121 other hosts, so cross-host requests also logged
**How found:** Noticed front-end/back-end length parsing mismatch (CL vs TE) and tested with dual Transfer-Encoding headers; while logging requests, observed requests for other hosts appearing in own form field, then reverse-IP lookup revealed shared Distil IP.
**Exploitation:** Attacker sends one smuggled POST whose body ends with an empty urlencoded address field; the back-end appends the next legitimate user's raw HTTP request as that field's value, which is persisted and readable by the attacker in their Legal Entity page. No victim interaction needed; captures cookies, SSO sig, password/PIN reset tokens within first 255 chars.
**Escalation:** Discovered shared Distil backend IP 192.225.xxx.x serving 121 other sites, extending the leak cross-tenant; reverse direction also possible via other hosts' longer input fields to bypass 255-char limit.
**Insight:** When a bot-protection/CDN layer sits in front of many tenants, test CL.TE desync against the shared edge and check whether a persisted form field can capture the appended next request; reverse-IP the edge to find co-tenant hosts and cross-leak.