HTTP request smuggling (CL.TE) → admin panel bypass

§ Context

Assumed environment: app sits behind a reverse proxy / WAF that doesn't normalise CL/TE conflicts identically to the backend. The /admin path is blocked at the proxy but routable on the backend.

§ Steps

1. 01
   Exfil sensitive dataExfiltration

   T1041— Exfiltration Over C2 Channel
2. 02
   Reach admin endpointPrivilege Escalation

   W-BFLA— Broken Function Level Authorization (API BFLA)
3. 03
   Bypass proxy ACL on /adminPrivilege Escalation

   W-HEADER-AUTH-BYPASS— X-Original-URL / X-Rewrite-URL Bypass
4. 04
   Detect CL.TE differentialDefense Evasion

   W-PARSER-DIFFERENTIAL— Parser Differential
5. 05
   Queue a smuggled request on a victim connectionImpact

   W-REQUEST-SMUGGLE-CLTE— HTTP Request Smuggling — CL.TE
6. 06
   Confirm smuggling with timing oracleImpact

   W-REQUEST-SMUGGLE-CLTE— HTTP Request Smuggling — CL.TE

§ References

• T1041Exfiltration Over C2 Channel

§ Frequently asked

What is the "HTTP request smuggling (CL.TE) → admin panel bypass" attack path?

Frontend uses Content-Length, backend uses Transfer-Encoding. Smuggle a request whose path bypasses the frontend's authentication checks. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Exfil sensitive data (T1041) — a exfiltration primitive. Assumed environment: app sits behind a reverse proxy / WAF that doesn't normalise CL/TE conflicts identically to the backend.

What is the final impact of this kill-chain?

The final step lands on Confirm smuggling with timing oracle (W-REQUEST-SMUGGLE-CLTE), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  SAML signature wrapping (XSW) → impersonate admin

  Capture a legitimate SAML response. Re-arrange the XML so the IdP's signature still validates against the original assertion, but the SP parses an attacker-injected assertion claiming Admin.

• Shared techniques2

  JWT RS256 → HS256 algorithm confusion → admin

  Server verifies any algorithm declared in the JWT header. Sign an HS256 token using the public RSA key as the HMAC secret — server accepts it as legit.