Prebuilt binaries will be published to Releases via the release workflow.

Both produce byte-identical payloads (enforced by a CI parity test). If the lab is running:

Expected output: 1 HTTP response (WebSocket upgrade rejected). Then verify:

The backend count > 0 and Nginx count = 0 means CWE-444 split confirmed. This PoC sends a single TCP segment — the body is the smuggled request; Nginx treats it as body, aiohttp treats it as a second request.

What this proves

• Parser confusion: aiohttp 3.14.1 _http_parser.pyx returns 2 (skip body) on upgrade detection before the body is consumed (line ~863). Body bytes remain in _message_tail and are fed back to the parser in web_protocol.py finish_response (line ~771).
• CWE-444 split: The frontend sees 1 request with body; the backend sees 2 pipelined requests. Request-count mismatch in logs.
• Access-control bypass: When Nginx has location /admin { deny all; }, the smuggled /admin still reaches the backend because Nginx routing decisions are made on the outer request only.
• No handler-level fix: await request.read() returns 0 bytes on upgrade requests in 3.14.1 — the body is withheld below the handler layer. Patch, or strip upgrade headers at the proxy on routes that must not switch protocols.

Full lab

Services:

Full Phase 1-3 findings in findings/.

Limitations (honest)

• Proxy must forward upgrade headers. Nginx configs that send Connection: close to the backend or strip Connection/Upgrade headers are not vulnerable. The config that exposes the split is the canonical WebSocket map snippet from Nginx's own proxying documentation.
• Smuggled response is absorbed by the proxy. In the demonstrated Nginx chain, the attacker receives only the outer /ws response. Evidence of smuggling is in the backend logs, not in the attacker response — a blind, one-way primitive in this topology. Other proxy topologies were not tested.
• Chunked framing is CL-specific in effect. Directly against aiohttp, Transfer-Encoding: chunked does NOT smuggle — the raw chunk-size line (e.g. 3e) hits the parser as an invalid method and the connection dies. Through Nginx it works, but via normalization: Nginx de-chunks the body and forwards a synthesized Content-Length, so the backend is exploited through the same CL path. The --chunked flag demonstrates the proxy path.
• Requires an endpoint that rejects WebSocket upgrades. The handler must return a non-WebSocketResponse. Most apps that don't use WebSockets on a route will reject by default (framework returns 404 or falls through to the next handler).

Files

Detection

See findings/fase3-deteccao.md for the full analysis. Summary, with the caveats that matter in production:

1. Request-count mismatch (backend > frontend) on the same connection. Note the backend logs the proxy's IP, not the client's — correlation requires normalizing X-Forwarded-For/Proxy Protocol, or logging an upstream connection ID + per-connection request sequence. Client IP + time window alone is weak (NAT, keep-alive, concurrency).
2. Backend request without frontend match: a restricted path in the backend log with no corresponding entry in the frontend access log. Filter internal subnets (health checks bypassing the proxy false-positive).
3. Upgrade rejection + different path from same client in ~100 ms. Medium confidence — legitimate pipelining produces similar intervals; the lab logger does not record remote port/connection ID, so "no new TCP handshake" is NOT something this data demonstrates.
4. Withheld-body middleware (content_length vs bytes from request.read()): fires on 3.14.1, quiet on 3.14.2. Detects, does not mitigate. Scope it (upgrade-candidate routes, small bodies, non-101 statuses) — the naive version buffers every body in memory.
5. Edge reqlen above header baseline on WebSocket endpoints — low confidence alone (cookies/JWT/tracing headers are noisy), but the only edge signal when the client sends no Content-Length (chunked ingress).