HTTP Header Injection, HTTP Response Splitting, CWE-113, CRLF, 0x20

Loading

Depending on the application. An attacker might carry out the following forms of attacks:

• Cross-site Scripting attack which can lead to session hijacking
• Session fixation attack by setting a new cookie, which can again lead to session hijacking

1. See the remedy for solution.
2. Ensure the server security patches are up to date and that the current stable version of the software is in use.

Do not allow newline characters in input. Where possible use strict white listing. If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.

Crafting the attack to exploit this issue is not a complex process. However most of the unsophisticated attackers will not know that such an attack is possible. Also an attacker needs to reach his victim by an e-mail or other similar method in order to entice them to visit the site or click upon a URL.