writeups.xyz / Abusing Client-Side Desync on Werkzeug

Submitter : c2a

Date: 7 June 2023

Bounty : undisclosed

Vulnerabilities :

• Client-Side Desync Attack
• HTTP Request Smuggling
• Account Takeover
• Open Redirect
• XSS

Programs :

• Werzeug

Authors :

• Mizu (@Kevin_mizu)

Link :
https://mizu.re/post/abusing-client-side-desync-on-werkzeug