Carriage Return Line Feed
CRLF Injection is a web security vulnerability that arises when an attacker injects unexpected Carriage Return (CR) (\r) and Line Feed (LF) (\n) characters into an application. These characters are used to signify the end of a line and the start of a new one in network protocols like HTTP, SMTP, and others. In the HTTP protocol, the CR-LF sequence is always used to terminate a line.
Summary
Methodology
HTTP Response Splitting is a security vulnerability where an attacker manipulates an HTTP response by injecting Carriage Return (CR) and Line Feed (LF) characters (collectively called CRLF) into a response header. These characters mark the end of a header and the start of a new line in HTTP responses.
CRLF Characters:
CR(\r, ASCII 13): Moves the cursor to the beginning of the line.LF(\n, ASCII 10): Moves the cursor to the next line.
By injecting a CRLF sequence, the attacker can break the response into two parts, effectively controlling the structure of the HTTP response. This can result in various security issues, such as:
Cross-Site Scripting (XSS): Injecting malicious scripts into the second response.
Cache Poisoning: Forcing incorrect content to be stored in caches.
Header Manipulation: Altering headers to mislead users or systems
Session Fixation
A typical HTTP response header looks like this:
If user input value\r\nSet-Cookie: admin=true is embedded into the headers without sanitization:
Now the attacker has set their own cookie.
Cross Site Scripting
Beside the session fixation that requires a very insecure way of handling user session, the easiest way to exploit a CRLF injection is to write a new body for the page. It can be used to create a phishing page or to trigger an arbitrary Javascript code (XSS).
Requested page:
HTTP response:
In the case of an XSS, the CRLF injection allows to inject the X-XSS-Protection header with the value value "0", to disable it. And then we can add our HTML tag containing Javascript code .
Requested page:
HTTP Response:
Open Redirect
Inject a Location header to force a redirect for the user.
Filter Bypass
RFC 7230 states that most HTTP header field values use only a subset of the US-ASCII charset.
Newly defined header fields SHOULD limit their field values to US-ASCII octets.
Firefox followed the spec by stripping off any out-of-range characters when setting cookies instead of encoding them.
嘊
%E5%98%8A
\u560a
%0A (\n)
嘍
%E5%98%8D
\u560d
%0D (\r)
嘾
%E5%98%BE
\u563e
%3E (>)
嘼
%E5%98%BC
\u563c
%3C (<)
The UTF-8 character 嘊 contains 0a in the last part of its hex format, which would be converted as \n by Firefox.
An example payload using UTF-8 characters would be:
URL encoded version
Labs
References
Last updated