The value of REST URL parameter 2 is copied into the Location response header. The payload 7d2d3%0d%0a4fb5754f9c5 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.
HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.
If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.
GET /mpa/7d2d3%0d%0a4fb5754f9c5/setCookie.do HTTP/1.1 Host: www.myproductadvisor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 00:08:56 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: UIVERSION_COOKIE=1; Path=/mpa/ Location: http://www.myproductadvisor.com/mpa/base/7d2d3 4fb5754f9c5/setCookie.do Content-Length: 0 P3P: policyref="/content/w3c/p3p.xml", CP="NOI DSP NID CURa ADMa DEVa TAIa PSAa PSDa OUR NOR IND COM NAV STA" Connection: close Content-Type: text/plain; charset=UTF-8
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.
You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.
GET /mpa/autobytel/setCookie.do HTTP/1.1 Host: www.myproductadvisor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 00:08:23 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: UIVERSION_COOKIE=1; Path=/mpa/ Set-Cookie: JSESSIONID=a7ff3102cc2a90029701232ccef5; Path=/mpa Location: http://www.myproductadvisor.com/mpa/cookiecheck.do?originalurl=aHR0cDovL3d3dy5teXByb2R1Y3RhZHZpc29yLmNvbS9tcGEvYXV0b2J5dGVsL3NldENvb2tpZS5kbw== Content-Length: 0 P3P: policyref="/content/w3c/p3p.xml", CP="NOI DSP NID CURa ADMa DEVa TAIa PSAa PSDa OUR NOR IND COM NAV STA" Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-c0a8010b=c0a801cd:0; path=/