CVE-2016-10711

What it actually does

Allows HTTP request smuggling by injecting crafted headers that cause the proxy to misinterpret request boundaries, enabling attackers to bypass access controls or poison caches.

Why it matters to the business

Attackers may gain unauthorized access to protected resources, manipulate cached content, or intercept traffic, leading to data exposure and operational disruption in environments using the affected proxy.

How an attack unfolds

An attacker sends a specially crafted HTTP request containing smuggling headers to a vulnerable Pound instance; the proxy fails to properly delimit requests, allowing subsequent requests to be interpreted as part of the first and bypassing security filters.

How to fix it

Upgrade Apsis Pound to version 2.8a or later. Review and harden any front-end proxy configurations to enforce strict request validation until patches are applied.

How to confirm the fix worked

Confirm the installed Pound version is 2.8a or newer. Test with known smuggling header patterns in a non-production environment to verify boundary enforcement.

Typical attack path

1. Identify a target using the vulnerable proxy version
2. Craft an HTTP request with ambiguous headers that exploit header parsing differences
3. Send the request to trigger request smuggling
4. Follow with a second request that gets misinterpreted and processed as part of the first
5. Achieve cache poisoning, unauthorized access, or other security control bypass

How to detect it

Review proxy access logs for repeated or malformed header patterns indicative of smuggling attempts; correlate with backend application logs showing unexpected request processing.

What your security team should do

• Prioritize upgrade of all Pound instances to 2.8a or later
• Implement WAF rules to block ambiguous or duplicate HTTP headers
• Monitor proxy logs for anomalous request patterns
• Replace deprecated Pound deployments with maintained alternatives where feasible