CODEWITHSUNDEEP
asp.net-mvchttpiishttp-headers
Ahmet Altun
Ahmet Altun

Reputation: 4039

How to Fix HTTP Request Smuggling on IIS

In my ASP.NET MVC application, I want to resolve the HTTP Request Smuggling Vulnerability issue.

I thought it would be sufficient if I blocked the requests which have a Transfer-Encoding: chunked header. In the IIS administration menu, I added a new Request Filtering rule for this. However that does not seem to fix it.

I wrote little .NET code to test if IIS generates a 404 error when chunked content is sent. When I add the transfer encoding header 1 time to my test client code as below, I do NOT receive 404—I receive 200.

httpRequest.Headers.Add("Transfer-Encoding", "chunked");

Interestingly, if I add the header 2 times (I mean duplicate it) like

httpRequest.Headers.Add("Transfer-Encoding", "chunked");
httpRequest.Headers.Add("Transfer-Encoding", "chunked");

The filtering rule applies, and I receive 404 as I expected.

How can I fix it?

Upvotes: 2

Views: 9257

Answers (1)

Michael come lately
Michael come lately

Reputation: 9323

A few months later, Microsoft added a patch wherein you can disable request smuggling with a registry key.

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.
  2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
  3. Set DWORD type value DisableRequestSmuggling to one of the following:
    • Set to 0 to disable the filter
    • Set to 1 to enable the filter
  4. Exit Registry Editor.
  5. Restart the computer.

Upvotes: 2

Related Questions