CL.TE HTTP Request Smuggling: A Bug Bounty Testing Guide
CL.TE means the front end trusts Content-Length while the back end honors Transfer-Encoding: chunked. Two servers read one byte stream and disagree about where the first request ends. The leftover bytes become the beginning of somebody else's request.
That sounds abstract until you see a normal page return another user's prefix, a cache entry acquire your marker, or a harmless probe stall for exactly the timeout you predicted. Request smuggling is a protocol bug, so precision matters more than payload volume.
Build the smallest timing probe
Use HTTP/1.1 and keep Burp Repeater on a single connection where possible. A classic CL.TE probe declares a body long enough for the front end, then gives the back end an incomplete chunk:
POST / HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked
3
x=1
The back end waits for the rest of the chunk framing while the front end believes six bytes completed the body. A delayed response is only a lead. Repeat against a control request, vary the body carefully, and rule out ordinary application latency.
Do not fire this through a shared connection pool at speed. One request can poison the next user's traffic. PortSwigger's HTTP Request Smuggler extension has safe detection options; read what each probe sends before enabling broad scans.
Confirm without touching another user
The best confirmation uses two requests you control. Send a smuggling request that leaves a prefix such as GET /404-smuggle-marker HTTP/1.1, then immediately send a benign follow-up on the same connection. If the second response changes predictably—perhaps a 404 for your marker—you have parser disagreement without waiting for a stranger's request.
Headers are messy in real stacks. Try obfuscated Transfer-Encoding only after the plain case:
- Duplicate TE headers with conflicting values
- Whitespace before the colon where the edge and origin parse differently
Transfer-Encoding: chunked, identity- Mixed casing or a tab after the header name
Every bypass should be tested slowly. A CDN may normalize headers before forwarding, while an origin proxy makes a different decision. Record whether the behavior survives a fresh connection and whether HTTP/2 clients are downgraded to HTTP/1 upstream.
From desync to impact
A timing delay proves suspicion, not severity. Strong impact might include cache poisoning, front-end route bypass, reflected data captured from your own second account, or request-prefix injection that changes the next controlled request. Never collect real users' cookies to make the report look stronger.
Use two accounts and a unique canary. If account A's smuggled prefix affects account B's next request, show only a disposable profile field or test endpoint. Note connection reuse requirements; a bug that needs a rare same-socket race can still matter, but the report should say so.
Mitigation belongs at the protocol boundary: use one parser interpretation end to end, reject requests carrying both CL and TE, normalize once, and avoid HTTP/1 downgrading where practical. CWE-444 names this class as inconsistent HTTP request interpretation. Pair that reference with PortSwigger's request smuggling research and OWASP's testing guidance so triage can reproduce the exact framing error.