Kiran 
A pair of researchers has shown that HTTP header injection, long dismissed as a low-severity nuisance, can be escalated into a self-replicating “desync worm” capable of hijacking sessions, poisoning caches, and stealing HTTPOnly cookies across entire CDNs.
The findings, published by Tom Stacey (@t0xodile) alongside Tobia Righi of TurtleSec, were presented at Black Hat USA and DEF CON and reframe a class of bugs that most triage teams have quietly downgraded for years.
The research began with a year-old Bluesky post claiming CRLF-based desync attacks were “not that uncommon” in the wild, a claim the pair initially doubted.
CRLF Desync Worm Turns HTTP Header Bugs
Digging into prior work James Kettle’s response queue poisoning research and Sergey Bobrov’s study of Nginx request-splitting misconfigurations they realized the root cause was widespread: when Nginx’s $uri variable feeds into a proxy_pass directive.
It silently URL-decodes CRLF sequences (%0d%0a), letting attackers inject arbitrary newlines into requests forwarded upstream. That single misconfiguration became the foundation for a dozen distinct exploitation paths.
Using this primitive, the team demonstrated classic CL.TE desyncs, response queue poisoning inside CDN infrastructure, and cache poisoning via a “HEAD gadget” refined with AI-assisted payload generation.
Real-world impact included stealing access tokens from a telecom’s internal infrastructure ($20,000 bounty), exfiltrating credit card data from a payment provider’s Kubernetes cluster, and hijacking TikTok user sessions via cookie-tossing ($4,500 bounty).
The most consequential discovery, however, was that many of these desyncs are entirely browser-compatible, meaning a victim’s own browser, once hit with an XSS payload, can be weaponized via fetch() or window.open() to replay the attack against other users, creating a self-propagating desync worm.
“What makes this research genuinely unsettling isn’t the novelty of any single technique; it’s that every one of these ‘moderate’ header-injection reports sitting in a triage backlog right now could plausibly be escalated the same way. Security teams have been grading this bug class on outdated assumptions,” the pair noted when explaining why they pushed the research so far past typical proof-of-concept demonstrations.
Perhaps the most technically significant contribution is the method for exploiting IP-locked and connection-locked desyncs, which were previously considered largely untriageable because they affect only users sharing a connection or a public IP.
By shifting execution into the victim’s browser using rapid iframe creation, window.open() sequencing, and the HTTP Range header to fine-tune “HEAD technique” payload sizes, the researchers converted these theoretically narrow bugs into practical, cross-user account takeovers, netting bounties as high as $5,000 and $3,255 on major streaming and software platforms.
The fix, according to the researchers, is straightforward but frequently missed: avoid using $uri or $document_uri inside proxy_pass or return directives in Nginx, OpenResty, and Tengine configurations, and ensure any custom regex variable matching excludes whitespace.
For a more permanent mitigation, they point to enabling HTTP/2 for upstream connections, echoing earlier guidance from the “HTTP/1.1 Must Die” research.
The researchers released an open-source Burp Suite extension and Nuclei templates so defenders and bug hunters can reproduce the detection techniques.
Their broader message to the security community is pointed: header injection reports shouldn’t be closed as low-impact without first testing for response queue poisoning, browser-powered exploitation, and worm-style propagation because, as their case studies show, the ceiling on this bug class is far higher than most triage guidelines assume.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
