NRDAX-T0110 - HTTP Header Spoofing Trust Bypass

mechanism

The defect is geth's --http.vhosts allowlist treating an empty/absent Host header as implicitly trusted rather than explicitly denying it, combined with an HAProxy h2->h1 downgrade path that forwards HTTP/2 requests with an empty :authority as an empty Host instead of rejecting or filling it. An attacker with raw-h2 capability sends a request with :authority="" through the HAProxy front; HAProxy forwards it as empty Host while a normal forbidden hostname would be rejected with 403. The measurable effect is a 200 response bypassing the vhost/anti-DNS-rebinding allowlist, granting access that the Host-based authorization was meant to block.

research

In-depth write-ups of this attack on nullrabbit.ai.

instances (1)

references

cite

https://nrdax.com/techniques/NRDAX-T0110

@misc{nrdax_NRDAX_T0110,
  title = {HTTP Header Spoofing Trust Bypass (NRDAX-T0110)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0110},
}

{
  "id": "nrdax-NRDAX-T0110",
  "type": "dataset",
  "title": "HTTP Header Spoofing Trust Bypass (NRDAX-T0110)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0110",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0110 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0110.svg)](https://nrdax.com/techniques/NRDAX-T0110-http-header-spoofing-trust-bypass)