Trustwave's 2024 Retail Report Series Highlights Alarming E-Commerce Threats and Growing Fraud Against Retailers. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave's 2024 Retail Report Series Highlights Alarming E-Commerce Threats and Growing Fraud Against Retailers. Learn More
Recently there has been increased interest in the impedance mismatch problem, which occurs between multiple layers of a HTTP stack (e.g. proxy/security/web server) when they interpret HTTP differently. If you recall, I wrote about it in March. Shortly after Sverre talked about his worries: Incompatible Parameter Parsing. Then, a few days ago, Watchfire released a detailed analysis of how to smuggle two requests in a transaction where there should be only one: HTTP Request Smuggling. Finally, yesterday Amit Klein posted a message to the web security list, subtitled "A survey of new attacks on the less explored parts of the web application".
This topic is of great interest to security professionals that work with HTTP (who isn't nowadays!). The more we talk about it the greater the understanding of the strengths and the weaknesses of layered approach to application protection. To the end users, this is another clear message they should work to deploy secure applications in the first place.
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.