Request Smuggling in Aspnet with Firestore

Request smuggling occurs when an application processes the same request differently depending on whether it is interpreted by the frontend (e.g., a reverse proxy or load balancer) and the backend (e.g., an ASP.NET application). In an ASP.NET application integrating with Google Cloud Firestore, this can arise from inconsistent parsing of HTTP messages, especially when custom headers, chunked transfer encoding, or body streams are involved.

Firestore clients in ASP.NET typically use the Google Cloud client library, which relies on HTTP/1.1 or HTTP/2 to communicate with Firestore’s backend. If the ASP.NET layer does not normalize and fully consume the incoming request body before passing it downstream, or if it forwards the request to Firestore with different hop-by-hop expectations, the frontend and backend may interpret message boundaries differently. For example, a request with a mismatched Content-Length and Transfer-Encoding header might be parsed differently by the ASP.NET pipeline versus the proxy, causing the backend to treat part of the smuggled payload as a new request.

In the context of Firestore, this can expose operations that the attacker did not intend to be reachable. An attacker might smuggle a request that reads or writes a document to a path they would not normally access, leveraging Firestore’s REST or RPC interfaces that the ASP.NET backend calls on their behalf. Because Firestore operations are authorized at the backend (using service account credentials), a smuggled request can bypass intended access controls if the backend does not revalidate path and permission assumptions for each proxied call.

Additionally, ASP.NET applications that accept uploads or batch operations and forward them to Firestore are at risk if the request is not strictly validated before being transformed. For instance, if the application parses JSON once for validation and then reuses the stream for Firestore writes without resetting the position, a smuggled body segment can be interpreted as a new Firestore operation. This can lead to privilege escalation (BOLA/IDOR) or data exposure when the smuggled request targets a different user’s document path.

Common real-world patterns that increase risk include: inconsistent use of Kestrel versus IIS integration, failure to buffer and validate the entire request body before processing, and forwarding requests to Firestore without ensuring headers like Content-Length are reconciled. Attack vectors such as CVE-style request splitting (e.g., two requests concatenated in one TCP stream) can cause the ASP.NET app to process an extra method or Firestore document path that was not intended by the client.

To mitigate request smuggling when ASP.NET communicates with Firestore, ensure the request is fully and consistently consumed and normalized before any Firestore interaction. Use middleware to buffer and validate the entire body, and enforce strict header reconciliation. The following practices and code examples help secure the integration.

1. Buffer and validate the request body before forwarding

Read the entire request body into a buffer in ASP.NET before any Firestore call. This prevents stream-position issues and ensures the same body is used for validation and for the downstream call.

// In an ASP.NET Core middleware or handler
public async Task InvokeAsync(HttpContext context, FirestoreDb firestoreDb)
{
    // Ensure the request body can be read multiple times
    context.Request.EnableBuffering();

    // Read and validate the full body as JSON
    using var reader = new StreamReader(context.Request.Body, leaveOpen: true);
    string requestBody = await reader.ReadToEndAsync();
    context.Request.Body.Position = 0; // reset for downstream use if needed

    // Validate structure (example: ensure document path is safe)
    using var jsonDoc = JsonDocument.Parse(requestBody);
    if (!jsonDoc.RootElement.TryGetProperty("documentPath", out var pathProp))
    {
        context.Response.StatusCode = 400;
        await context.Response.WriteAsync("Missing documentPath");
        return;
    }

    string documentPath = pathProp.GetString();
    if (!IsValidDocumentPath(documentPath))
    {
        context.Response.StatusCode = 403;
        await context.Response.WriteAsync("Invalid document path");
        return;
    }

    // Proceed to Firestore with the validated body/path
    DocumentReference docRef = firestoreDb.Document(documentPath);
    await docRef.SetAsync(JsonDocument.Parse(requestBody));
}

private bool IsValidDocumentPath(string path)
{
    // Enforce strict allowlist rules to prevent traversal or unauthorized collections
    var allowedPrefixes = new[] { "users/", "public/" };
    return allowedPrefixes.Any(p => path.StartsWith(p, StringComparison.Ordinal));
}

2. Enforce transfer-encoding and content-length consistency

Reject requests that have conflicting Transfer-Encoding and Content-Length headers, as these are common indicators of smuggling attempts. This should be done before any Firestore interaction.

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.Use(async (context, next)
    {
        var request = context.Request;
        // Reject suspicious combinations that may indicate smuggling
        bool hasChunked = request.Headers.TransferEncoding.ToString().Contains("chunked", StringComparison.OrdinalIgnoreCase);
        bool hasContentLength = request.Headers.ContentLength.HasValue;

        if (hasChunked && hasContentLength)
        {
            context.Response.StatusCode = 400;
            await context.Response.WriteAsync("Conflicting Transfer-Encoding and Content-Length");
            return;
        }

        await next();
    });

    app.UseRouting();
    app.UseEndpoints(endpoints => endpoints.MapControllers());
}

3. Use strongly typed models and avoid stream reuse

Do not reuse the original request stream when calling Firestore. Deserialize into a concrete model first, then serialize again for Firestore. This prevents injection of smuggled data via unexpected stream positions.

public class DocumentRequest
{
    public string DocumentPath { get; set; }
    public JsonElement Payload { get; set; }
}

// Deserialize once
var model = JsonSerializer.Deserialize(requestBody);
// Validate and map to Firestore
var docRef = firestoreDb.Document(model.DocumentPath);
await docRef.SetAsync(model.Payload.GetRawText());

4. Apply principle of least privilege to Firestore credentials

Ensure the service account used by the ASP.NET app has minimal permissions for the intended Firestore paths. This limits the impact if smuggling bypasses validation by restricting what an attacker can read or write.

5. Monitor and normalize forwarded headers

When forwarding requests to Firestore via REST, explicitly set headers and avoid blindly passing incoming headers. This prevents header smuggling (e.g., via X-Forwarded-For affecting authorization logic).

using var httpClient = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "https://firestore.googleapis.com/v1/projects/.../documents:commit");
request.Headers.Add("Authorization", "Bearer " + token);
// Do NOT forward raw incoming headers; set only necessary ones
var content = new StringContent(requestBody, Encoding.UTF8, "application/json");
request.Content = content;
var response = await httpClient.SendAsync(request);