Lab 222 — DeployForge — CL.0 HTTP Request Smuggling via Health Check Endpoint

hackadvisor

Task: CI/CD platform with nginx proxy blocking /admin/secrets; /api/health endpoint ignores Content-Length (CL.0 vulnerable). Solution: CL.0 HTTP request smuggling — POST to /api/health with body containing smuggled GET /admin/secrets prefix, backend ignores body and processes smuggled request, bypassing nginx ACL.