CyberRota Analysis
AI-GeneratedTelerik Fiddler Classic for Windows prior to version 6.0.20262.10021 is vulnerable to front-end request desynchronization, allowing a local attacker with low privileges to manipulate requests by sending a malformed request containing both Content-Length and Transfer-Encoding headers. This can lead to the splitting of a single request into two, enabling the attacker to receive an additional smuggled response from the origin server. Organizations using affected versions of Fiddler should prioritize upgrading to mitigate potential exploitation risks.
Original NVD Description
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.