Collected research

Knocking on the Front Door (client side desync attack on Azure CDN)

0xJeti · Jeti's blog · 31 July 2023

Applies client-side desynchronization to Azure Front Door, whose HTTP redirect path ignored Content-Length while sharing connections across customer hosts. Browser-issued requests can steal a victim request or queue an attacker response that executes as cross-customer XSS.

Record

Researcher

0xJeti

Published by

Jeti's blog

Date

31 July 2023

In the archive

• Collected in the 2023 research round

Tags

• desync
• request-smuggling
• azure
• cdn
• xss
• session-cookie
• attack-chain
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of 0xJeti, first published at the original source. Preserved copies are kept so the citation survives its host.