# Unauthenticated request smuggling on launchpad.37signals.com

CL.TE desync on launchpad.37signals.com via duplicate Transfer-Encoding headers let an unauthenticated attacker poison the backend socket, redirect victims, and capture their cookies.

- Payout: hidden
- Severity: critical
- Program: Basecamp
- Found by: hazimaslam
- Disclosed: 2020-10-28
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/867577
- Library page: https://bugbountylibrary.com/r/h1%3A867577
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical tech:ruby technique:parser-differential vuln:cache-deception vuln:request-smuggling

**Target:** Rails app behind frontend proxy at launchpad.37signals.com
**Root cause:** Frontend uses Content-Length when the last Transfer-Encoding is invalid, while the backend honors the earlier valid chunked Transfer-Encoding, desynchronizing the two parsers.
**Steps:**
1. Send `POST /identity` with `Content-Length: 69`, `Transfer-Encoding: chunked`, `Transfer-Encoding: foo`, then a chunked body `3\r\nx=1\r\n0\r\n\r\n` followed by a smuggled `GET /` with `X-Forwarded-Host: hazimaslam.com`.
2. Frontend sees invalid second TE and uses Content-Length; backend uses chunked TE and treats the trailing bytes as a new request.
3. Queue 6 victim `GET /signin` requests on the same connection; one receives the poisoned response redirecting to attacker domain.
4. For cookie theft, smuggle a `POST /identity` with `_method=patch` and attacker's own session cookies to store the next victim's request headers/cookies, then view them at `/identity/edit`.
**How found:** Observed that the frontend and backend disagree on duplicate Transfer-Encoding headers (frontend falls back to Content-Length on invalid TE, backend honors valid chunked TE), then crafted a CL.TE desync payload.
**Exploitation:** Attacker poisons the backend socket with a smuggled request so the next victim's request is prefixed by attacker-controlled data, causing redirects to attacker domain or storage of victim headers/cookies retrievable via the attacker's own account.
**Escalation:** Chained desync with a stored-request primitive to capture arbitrary visitors' session cookies and headers, enabling mass account takeover and JS/keylogger injection via redirect.
**Insight:** When testing request smuggling, send duplicate Transfer-Encoding headers where the last is invalid (e.g. `foo`): frontends that validate only the final TE fall back to Content-Length while backends honor the earlier chunked TE, yielding a reliable CL.TE desync.