AI-Assisted HTTP Terminator Discovers New HTTP Desynchronization Techniques and Apache Zero-Day Vulnerability

An AI-assisted system called HTTP Terminator discovered novel HTTP desynchronization techniques and a zero-day vulnerability in Apache Traffic Server, including methods like 'dangling-byte' to exploit response queue poisoning. The research also introduced the 'Shared-Parser Confusion' attack concept, highlighting ongoing challenges in HTTP/1.1 security.

PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors.

PortSwigger said a separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. Kettle said HTTP Terminator tested 30,000 websites where scanning

Read original article