cve/2019/CVE-2019-18277.md

### [CVE-2019-18277](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18277)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).

### POC

#### Reference
- https://nathandavison.com/blog/haproxy-http-request-smuggling

#### Github
- https://github.com/3th1c4l-t0n1/awesome-csirt
- https://github.com/ARPSyndicate/cvemon
- https://github.com/BLACKHAT-SSG/Awesome-HTTPRequestSmuggling
- https://github.com/PwnAwan/Awesome-HTTPRequestSmuggling
- https://github.com/Spacial/awesome-csirt
- https://github.com/chenjj/Awesome-HTTPRequestSmuggling