Bug-Bounty

HTTP request smuggling arises from RFC 7230 ambiguity: when a proxy and backend disagree on where one request ends and the next begins, attacker-controlled bytes prepend to a victim’s request. CL.TE embeds a hidden TE chunk; TE.CL sets a short Content-Length; H2 downgrade reintroduces CL.TE on H1 backend connections after H2 header stripping. In production proxy chains with persistent connections and traffic volume, a single smuggle primitive becomes a credential harvester. Full byte-level mechanics, Burp Suite detection methodology, and mitigation per proxy tier.

Three compounding weaknesses in ArubaOS 8.13.2.0 ICMP handler: IP Total Length over-read reads 18 bytes past actual frame data into Ethernet padding (CWE-126); TTL=0 packets are processed and replied to in RFC 791 violation (CWE-1284); ICMP checksums are never validated (CWE-354). TTL=0 makes extraction invisible — routers don’t forward, IDS ignores, firewalls don’t log. 27/27 crafted probes confirmed. On physical AOS-8 hardware with active management traffic, the 18-byte DMA region contains previous frame fragments. CVE-2003-0001 and CVE-2021-3031 accepted on identical mechanism without physical hardware PoC.

ArubaOS 8.13.2.0 ships default-xml-api AAA profile on port 32000/TCP with no authentication. The XML parser processes SYSTEM entity declarations and resolves them outbound. Four independent evidence items: wire-level pcap confirms controller TCP connection to attacker listener, target sshd log shows 127.0.0.1-sourced GET request impossible to produce externally, attacker HTTP server logged three DTD fetches at 02:33/02:36/02:38, nine internal ports confirmed open via dialog success responses. CWE-611. CVSS 9.3 Critical. Bugcrowd closed as theoretical. No fix issued.

ArubaOS 8.13.2.0 does not validate ICMP Echo Request source IPs against MAC/IP bindings or apply uRPF — attacker MAC with victim IP is accepted and replied to (CWE-290). Broadcast source IP (192.168.56.255) causes the controller to reply to ff:ff:ff:ff:ff:ff, delivering the reply to every host on the L2 segment (CWE-406). Two-machine evidence: Parrot OS attacker sends spoofed request, Windows victim receives unsolicited Echo Reply id=0xc101 confirmed in independent pcap. No ICMP request was sent from the victim. RFC 1122 §3.2.2.6 violation. Bugcrowd closed as expected behavior. No fix issued.