Http Request Smuggling in Feathersjs

Detecting Http Request Smuggling in Feathersjs requires examining both the application code and runtime behavior. Start by analyzing your middleware stack for parsing inconsistencies:

# Check for vulnerable middleware ordering
node -e "
const app = require('./app');
const layers = app._router.stack;
layers.forEach((layer, i) => {
  console.log(i, layer.name, layer.regexp);
});
"

Look for patterns where body parsers execute before multipart parsers, or where multiple parsers could conflict. The Feathers CLI-generated applications often include this vulnerability by default.

For runtime detection, use a tool like middleBrick to scan your Feathersjs API endpoints. middleBrick's black-box scanning approach tests the unauthenticated attack surface by sending specially crafted requests that probe for smuggling vulnerabilities:

npm install -g middlebrick

# Scan your Feathersjs API
middlebrick scan http://localhost:3030

middleBrick tests for smuggling by sending requests with manipulated Content-Length and Transfer-Encoding headers, then analyzing the server's response to detect ambiguity. The scanner checks if the server processes requests in a way that could allow request smuggling, providing a security risk score and specific findings.

Manual testing involves sending crafted requests through your Feathersjs application:

const axios = require('axios');

const testSmuggling = async () => {
  const payload = `POST /test HTTP/1.1\r\n` +
    `Host: localhost:3030\r\n` +
    `Content-Type: application/json\r\n` +
    `Content-Length: 4\r\n` +
    `\r\n` +
    `{}` +
    `GET /admin HTTP/1.1\r\n` +
    `Host: localhost:3030\r\n` +
    `\r\n`;

  try {
    const response = await axios.post('http://localhost:3030/', payload, {
      headers: { 'Content-Type': 'application/http' }
    });
    console.log('Response:', response.data);
  } catch (error) {
    console.error('Test failed:', error.message);
  }
};

Monitor your Feathersjs logs and error tracking to identify parsing errors or unexpected behavior when processing ambiguous requests.

Fixing Http Request Smuggling in Feathersjs applications requires addressing both middleware configuration and request parsing consistency. Start with middleware ordering and configuration:

const express = require('express');
const feathers = require('@feathersjs/feathers');
const bodyParser = require('body-parser');
const multer = require('multer');

const app = express(feathers());

// Use a single, consistent body parser
app.use(bodyParser.json({ strict: true }));
app.use(bodyParser.urlencoded({ extended: false }));

// Configure multer with strict limits and type checking
const upload = multer({
  limits: {
    fileSize: 1000000, // 1MB limit
    files: 1
  },
  fileFilter: (req, file, cb) => {
    if (file.mimetype !== 'application/json') {
      return cb(new Error('Invalid file type'));
    }
    cb(null, true);
  }
});

// Use a single, consistent entry point for multipart
app.use('/upload', upload.single('file'), async (req, res) => {
  // Process file securely

The key is using strict parsing options and avoiding multiple parsers that could conflict. Configure Express to reject ambiguous requests:

app.use((req, res, next) => {
  // Reject requests with both Content-Length and Transfer-Encoding
    return res.status(400).json({ error: 'Ambiguous content encoding' });
  }
  next();

For Feathers services, implement input validation at the service level:

const { BadRequest } = require('@feathersjs/errors');

class MessagesService {
  async create(data, params) {
    // Validate request structure
    if (typeof data !== 'object' || data === null) {
      throw new BadRequest('Invalid request format');
    }
    // Additional validation
  }
}

When using transports like Socket.io with Feathers, configure strict parsing:

const socketio = require('@feathersjs/socketio');

app.configure(socketio(function(io) {
  io.use((socket, next) => {
    // Validate handshake data
      return next(new Error('Authentication required'));
    }
    next();
  });
}));

For production deployments, ensure your reverse proxy and Feathers application agree on parsing rules. Configure your proxy to use a single, consistent parsing strategy and validate that it matches your Feathers configuration.