H2C Smuggling Attack

The H2C Smuggling attack is a web security attack that allows attackers to exploit vulnerabilities in the handling of HTTP/2 connections, particularly in scenarios where a web application supports both HTTP/1 and HTTP/2 protocols.

• "H2C" stands for **HTTP/2 over TCP (without net/sec/PKI/TLS),** and smuggling refers to the attacker's ability to craft requests that mislead security controls or frontend/backend communication processes within a web application's architecture.
• This type of attack can lead to various security breaches, including cache poisoning, bypassing security controls, and obtaining unauthorized access to sensitive information.

sequenceDiagram
    participant A as Attacker
    participant P as HTTP/2 Proxy/CDN
    participant B as HTTP/1.1 Backend
    participant V as Victim User
    
    Note over A,V: Phase 1: Setup - Normal Traffic Flow
    V->>P: HTTP/2 Request
    P->>B: HTTP/1.1 Request (downgrade)
    B->>P: HTTP/1.1 Response
    P->>V: HTTP/2 Response
    
    Note over A,V: Phase 2: Crafting Malicious HTTP/2 Request
    Note right of A: Attacker crafts HTTP/2 request with
conflicting headers or pseudo-headers
    
    A->>P: HTTP/2 Request with smuggled content
    Note right of A: Request contains:
- Conflicting Content-Length
- Transfer-Encoding headers
- Malformed pseudo-headers
    
    Note over A,V: Phase 3: Protocol Downgrade & Parsing Confusion
    P->>P: Parse HTTP/2 request
    Note right of P: Proxy interprets request
according to HTTP/2 rules
    
    P->>B: Convert to HTTP/1.1 request
    Note right of P: Proxy converts headers
but creates ambiguous HTTP/1.1
    
    Note over A,V: Phase 4: Backend Misinterpretation
    B->>B: Parse HTTP/1.1 request differently
    Note right of B: Backend sees smuggled request
as separate HTTP/1.1 request
    
    B->>P: Response to "first" request
    B->>P: Response to "smuggled" request
    
    Note over A,V: Phase 5: Response Desynchronization
    P->>A: Response (may be wrong response)
    
    Note over A,V: Phase 6: Victim Request Poisoning
    V->>P: Legitimate HTTP/2 request
    P->>B: HTTP/1.1 request (normal)
    
    B->>P: Response meant for smuggled request
    Note right of B: Backend responds with
attacker's smuggled response
    
    P->>V: Poisoned response to victim
    Note right of V: Victim receives attacker's
response instead of legitimate one
    
    Note over A,V: Phase 7: Attack Consequences
    Note over V: Victim may receive:
- Sensitive data from other users
- Malicious redirects
- Admin panel access
- Session hijacking responses