如何修复 IIS 上的 HTTP 请求走私

Question

In my ASP.NET MVC application, I want to resolve HTTP Request Smuggling Vulnerability issue.

I thought it would be sufficient if I blocked the requests which has "Transfer-Encoding: chunked" header. On IIS administation menu, I added new Request Filtering rule for this. However that does not seem to fix.

I wrote little .NET code to test if IIS generates 404 error when chunked content is sent. When I add the transfer encoding header 1 time to my test client code as below, I do NOT receive 404, I receive 200.

httpRequest.Headers.Add("Transfer-Encoding", "chunked");

Interestingly, I add the header 2 times (I mean duplicate it) as

httpRequest.Headers.Add("Transfer-Encoding", "chunked");
httpRequest.Headers.Add("Transfer-Encoding", "chunked");

The filtering rule applies and I receive 404 as I expected.

How can I fix it?

Answer 1

A few months later, Microsoft added a patch wherein you candisable request smuggling with a registry key .

1. Click Start, click Run, type Regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\HTTP\\Parameters
3. Set DWORD type value DisableRequestSmuggling to one of the following:
   • Set to 0 to disable the filter
   • Set to 1 to enable the filter
4. Exit Registry Editor.
5. Restart the computer.