New CRLF Desync Attack Lets Hackers Steal HTTPOnly Cookies and Hijack Accounts

Security researchers Tom Stacey from PortSwigger and Tobia Righi from TurtleSec have introduced a new category of HTTP request smuggling attacks known as “CRLF-Powered Desync Attacks.”

This method exploits a frequently overlooked HTTP header injection vulnerability, which can lead to full account takeovers, theft of HTTPOnly cookies, and even the creation of self-propagating desync worms.

New CRLF Desync Attack

The technique exploits a common misconfiguration in Nginx, where the `$uri` variable is included directly in the `proxy_pass` directive.

When this occurs, Nginx URL-decodes the request path before forwarding it upstream, including any CRLF sequences (%0d%0a).

This allows attackers to inject arbitrary newlines and headers into the request sent to the backend server, turning what appears to be a minor header-injection issue into a means of achieving complete control over the structure of the upstream HTTP request.

The researchers demonstrated that by splitting a single malicious request into two complete requests using consecutive CRLF sequences, attackers can trigger Response Queue Poisoning (RQP).

This technique, originally described by James Kettle, causes the server to lose track of which response belongs to which client, resulting in users receiving each other’s responses.

In one instance, this vulnerability was found deep within a CDN’s shared infrastructure, allowing the researchers to intercept session cookies and authentication tokens from thousands of unrelated applications hosted on the same platform.

The team also showcased more sophisticated CL.TE (Content-Length/Transfer-Encoding) desynchronization attacks achieved by merely injecting a single Transfer-Encoding header.

This allowed them to bypass defenses that blocked traditional double-CRLF request splitting. Against a major telecom provider, they earned a $20,000 bounty after extracting internal access tokens by executing the exploit across 500 concurrent connections for over 20 minutes.

A similar flaw in a payment provider’s session cookie handling exposed credit card numbers and personally identifiable information (PII) across several corporations that used the same Kubernetes-hosted infrastructure.

Browser-Based Exploitation and HTTPOnly Cookie Theft

Building on previous research regarding “Browser-Powered Desync Attacks,” Stacey and Righi discovered that most CRLF-powered desyncs are compatible with fetch specifications.

This means they can be triggered directly from a victim’s browser using JavaScript `fetch()` calls or simple navigation, without requiring direct network access to the backend.

This browser-driven method allows attackers to bypass IP- and connection-locked protections that usually prevent cross-network exploitation, effectively generating cross-site scripting “out of thin air” to steal HTTPOnly cookies that are otherwise inaccessible to client-side scripts.

Perhaps the most concerning aspect is the theoretical, now practically demonstrated, concept of desync worms. In this scenario, a victim’s browser, once compromised via injected XSS, could be repurposed as an attack platform to launch the same fetch-based desync against other users, allowing the exploit to spread exponentially without further involvement from the attacker.

Case studies from Portswigger highlight various vulnerabilities, including a major phone manufacturer’s account subdomain (leading to blind XSS pingbacks from devices worldwide), a social media CDN vulnerable to home-page cache poisoning via a HEAD request gadget, and a clothing retailer where a testing error inadvertently hijacked live shopping sessions before being weaponized into full account takeovers via email replacement, resulting in a $2,200 bounty.

Organizations utilizing Nginx with `$uri` in `proxy_pass` directives should conduct an immediate audit of their configurations, as this specific misconfiguration underpins the majority of reported cases.

The research, co-presented at Black Hat USA and DEF CON, highlights that header injection, previously dismissed as low severity, can lead to critical, wormable vulnerabilities when combined with request smuggling and browser execution contexts.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC