CRLF injection
Theory
CRLF represents termination of line:
CR = Carriage Return ()
LF = Line Feed ()
Windows and the protocol HTTP uses the CRLF however, Linux doesn't (it only uses LF). The CRLF injection is a type of attack where an attacker injects a termination of line into an application (via HTTP or URL) to provoke other types of vulnerability (HTTP Response Splitting, Log Injection...).
Practice
HTTP Response Splitting
Reconnaissance
Important: before even considering a CRLF injection, testers have to find any data that is sent in a request and reflected in the response (that follows the previous request).
An example by SecureFlag considers an application that in case of error (/?error=Page+Not+found), redirects the user using the Location HTTP header while reflecting the value of the error parameter:
From cases similar to this one, testers have to find a place where CRLF injection is possible, such as:
URL:
https://example.com/<CRLF_injection>Query parameter:
https://example.com/lang=en<CRFL_injection>
Upon using a CRLF injection, testers can inject arbitrary HTTP headers.
Filter bypass: one can bypass filters using UTF-8 encoding
CRLF = %E5%98%8A%E5%98%8D
Session fixation
A good example of session fixation (with CRLF injection) comes from the CVE-2017-5868 and is explained in this post.
An attacker notice that the parameter
__session_startin OpenVPN is vulnerable to CRLF injection.The attacker crafts an URL by setting a cookie:
The attacker sends this crafted URL to a victim.
The victim opens the URL and authenticates itself. Once authenticated, the cookie will be associated with its session.
The attacker can now use the cookie with the fixed session to access the victim's profile.
Cross-Site Scripting (XSS)
PayloadsAllTheThings has an interesting payload to write a document, and therefore include an XSS.
Requested page:
HTTP response:
Resources
Last updated
Was this helpful?
