🟠 High | Source: The Hacker News
PortSwigger’s AI-assisted research tool, HTTP Terminator, has discovered novel HTTP request smuggling (desync) techniques by evaluating 30,000 candidate attack vectors across 30,000 websites. A separate human-guided investigation also uncovered a zero-day vulnerability in Apache Traffic Server. HTTP desync vulnerabilities can allow attackers to bypass security controls, poison caches, hijack requests, or access internal systems behind shared proxies and load balancers.
Security Architect’s Take: Review your stack for any use of Apache Traffic Server and apply patches as soon as they are released. Audit your HTTP pipeline for shared proxy or load balancer configurations that may be susceptible to request smuggling — tools such as PortSwigger’s HTTP Request Smuggler can assist with detection in pre-production environments.
Original advisory: AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day