[steelbrain]

Forgive my optimism here but this seems overblown and trivial to detect and reject in firewalls/cdns.

Cloudflare most recently blocked a vulnerability affecting some php websites where a zip file upload contains a reverse shell. This seems plain in comparison (probably because it is).

This sensationalist headline, that doomsday style clock (as another poster shared) makes me question the motives of these researchers. Have they shorted any CDN stocks?

[Retr0id]

The underlying flaw is a parser differential. To detect that generically you'd need a model of both(/all) parsers involved, and to detect when they diverge. This is non-trivial.

[charcircuit]

You can have the CDN normalize requests so that it always outputs wellformed requests. This way only one parser deals with an untrusted / ambiguous input.

[bkallus]

I have been working on this :)

https://github.com/narfindustries/http-garden