# Making HTTP header injection critical via response queue poisoning

Path-based CRLF request header injection on a front-end was upgraded into request smuggling and response queue poisoning, leaking other users' authenticated responses.

- Payout: $12,500
- Severity: critical
- Program: -
- Credited: James Kettle
- Disclosed: 2022-09-22
- Write-up quality: 9/10
- Original: https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning
- Library page: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-making-http-header-injection-critical-via-response-queue-poisoning
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research sev:critical tech:rest technique:chained vuln:cache-deception vuln:crlf-injection vuln:request-smuggling

**Target:** Front-end HTTP server with path-based CRLF header injection
**Root cause:** Front-end reflects CRLF in the request path into the upstream request, letting an attacker inject headers and a full second request; keep-alive plus a crafted prefix combines with trailing junk to desync the back-end response queue.
**Steps:**
1. Confirm injection: `GET /%20HTTP/1.1%0d%0aHost:%20redacted.net%0d%0a%0d%0a HTTP/1.1` returns 200
2. Exit context cleanly: `GET /%20HTTP/1.1%0d%0a%0d%0a HTTP/1.1` yields 400 with `Connection: close`
3. Inject `Connection: keep-alive` to keep back-end socket open after first response
4. Inject a second request prefix: `GET /%20HTTP/1.1%0d%0aHost:%20redacted.net%0d%0aConnection:%20keep-alive%0d%0a%0d%0aGET%20/%20HTTP/1.1%0d%0aFoo:%20bar HTTP/1.1`
5. Trailing junk completes the second request, poisoning the response queue
**How found:** Reporter xorb emailed a path-based CRLF header injection; Kettle hypothesized header injection could be upgraded to request smuggling, then iteratively added context-exit, keep-alive, and a second-request prefix to test desync.
**Exploitation:** Attacker sends the crafted request to the front-end; the injected keep-alive plus second-request prefix desyncs the back-end so subsequent responses are delivered to the wrong (attacker) connection, intermittently exposing responses intended for other authenticated users.
**Escalation:** Upgraded a moderate header injection into critical response queue poisoning by chaining with request smuggling; also notes bypassing the stacked-response defence by injecting many newlines to delay the injected response past the front-end's over-read.
**Insight:** When you find CRLF header injection, don't stop at XSS/redirect: inject `Connection: keep-alive` and a full second request prefix, and account for server-appended trailing headers/body to complete the smuggled request. If response-header-injection desync fails, suspect a stacked-response over-read defence and delay the injected response with many newlines.