HTTP Request Smuggling in Microsoft IIS Server

This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Community Hub.

Symptoms - 

Security scans show Request Smuggling vulnerability on IIS server.

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.


The vulnerability exists due to the way that HTTP proxies (front-end) and web servers (back-end) that do not strictly adhere to RFC standards handle sequences of HTTP requests received from multiple sources. A remote attacker can send a specially crafted request to a targeted IIS Server, perform HTTP request smuggling attack and modify responses or retrieve information from another user's HTTP session.




Enable the request smuggling filter on your web server by using the Registry Editor

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.
  2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
  3. Set DWORD type value DisableRequestSmuggling to one of the following:
    • Set to 0 to disable the filter
    • Set to 1 to enable the filter
  4. Exit Registry Editor.
  5. Restart the computer.



Leave a Reply

Your email address will not be published. Required fields are marked *


This site uses Akismet to reduce spam. Learn how your comment data is processed.