CRLF injection
Last updated
Was this helpful?
Last updated
Was this helpful?
CRLF represents termination of line:
CR = Carriage Return ()
LF = Line Feed ()
Windows and the protocol HTTP uses the CRLF however, Linux doesn't (it only uses LF). The CRLF injection is a type of attack where an attacker injects a termination of line into an application (via HTTP or URL) to provoke other types of vulnerability (HTTP Response Splitting, Log Injection...).
Important: before even considering a CRLF injection, testers have to find any data that is sent in a request and reflected in the response (that follows the previous request).
An example by considers an application that in case of error (/?error=Page+Not+found), redirects the user using the Location HTTP header while reflecting the value of the error parameter:
From cases similar to this one, testers have to find a place where CRLF injection is possible, such as:
URL: https://example.com/<CRLF_injection>
Query parameter: https://example.com/lang=en<CRFL_injection>
Upon using a CRLF injection, testers can inject arbitrary HTTP headers.
CRLF = %E5%98%8A%E5%98%8D
An attacker notice that the parameter __session_start in OpenVPN is vulnerable to CRLF injection.
The attacker crafts an URL by setting a cookie:
The attacker sends this crafted URL to a victim.
The victim opens the URL and authenticates itself. Once authenticated, the cookie will be associated with its session.
The attacker can now use the cookie with the fixed session to access the victim's profile.
Requested page:
HTTP response:
Filter bypass: one can using UTF-8 encoding
A good example of session fixation (with CRLF injection) comes from the CVE-2017-5868 and is explained in this .
has an interesting payload to write a document, and therefore include an XSS.
