Improper Neutralization of CRLF Sequences ('CRLF Injection')

Opis

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Skutki

• Integrity

  Modify Application Data

Zapobieganie

• Implementation

  Avoid using CRLF as a special sequence.

• Implementation

  Appropriately filter or quote CRLF sequences in user-controlled input.

Przykłady podatności

• CVE-2002-1771 CRLF injection enables spam proxy (add mail headers) using email address or name.
• CVE-2002-1783 CRLF injection in API function arguments modify headers for outgoing requests.
• CVE-2004-1513 Spoofed entries in web server log file via carriage returns
• CVE-2006-4624 Chain: inject fake log entries with fake timestamps using CRLF injection
• CVE-2005-1951 Chain: Application accepts CRLF in an object ID, allowing HTTP response splitting.
• CVE-2004-1687 Chain: HTTP response splitting via CRLF in parameter related to URL.

Słabość nadrzędna

• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Może prowadzić do

• CWE-117 Improper Output Neutralization for Logs

Słabości podrzędne

• CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific

Źródła

1. CRLF Injection — Ulf Harnhammar, Bugtraq, 2002
2. CRLF Injection — Imperva
3. CRLF injection — R00tendo, 2024