The CRLF Injection Attack (sometimes also referred to as HTTP Response Splitting) is a fairly simple, yet extremely powerful web attack. hackers are actively exploiting this web application vulnerability to perform a large variety of attacks that include XSS cross-site scripting, cross-user defacement, positioning of client's web-cache, hijacking of web pages, defacement and a myriad of other related attacks. A number of years ago a number of CRLF injection vulnerabilities were also discovered in Google's Adwords web interface.
Sounds scary to you? You bet. Are you vulnerable? Quite possibly, and this is why.
CRLF Injection mechanic
CRLF (Carriage Return and Line Feed) is a very significant sequence of characters for programmers. these two special characters represent the End Of Line (EOL) marker for accessing Internet protocols, including, but not limited to MIME (e-mail), NNTP (newsgroups) and more importantly HTTP. when programmers write code for web applications they split headers based on where the CRLF is found. if a malicious user is able to inject his own CRLF sequence into an HTTP stream, he is able to maliciously control the way a web application functions.
A simple CRLF Injection example
Suppose you run a vulnerable website that has a member section. an attacker will send an email to one of your members containing a CRLF-crafted link. this link appears to be legitimate; after all it points to your own website. the link might look something like the one below:
Http://www.yoursite.com/somepage.php? Page = % 0d % 0aContent-Type: text/html % 0d % 0 aHTTP/1.1 200 OK % 0d % 0aContent-Type: text/html % 0d % 0a % 0d % 0a % 3 Chtml % 3 EHacker Content % 3C/html % 3E
When the victim clicks on the link he will be served with the following HTML page:
<Html> Hacker Content
This attack appears to simply show the words "Hacker Content" on the victim's machine however the danger is that YOUR server has generated this HTML code, so define tively the hacker has injected HTML code into the victims browser via YOUR web server! Ouch. More sophisticated variations of this example can lead to launch ioning of the client's web-cache, cookies, XSS, temporary or permanent defacement of web pages and even information theft.
Example insight
If you look closely at the malicious URL you might notice a few occurences of the pattern % 0d % 0a. this pattern is the HTTP equivalent of CRLF and is the reason why we call this technique it a CRLF Injection Attack.
Known countermeasures
The only valid tive countermeasure is to properly sanitize URLs that point to web pages on your site containing any server re-direction code. www.2cto.com Finding these holes is not a trivial task; most web applications today are littered with server-side redirects so the location of these vulnerabilities is not always clear, and it is very easy to miss most of them. normally it can take hundreds of man-hours to test all your web page redirects and therefore it is very common to use an automatic tool such as a web vulnerability failed to find such web vulnerabilities.
Check if your website is vulnerable to CRLF injection
Acunetix Web Vulnerability extends ensures website security by automatically checking for CRLF Injection, SQL injection, Cross site scripting attacks and other vulnerabilities. it checks password strength on authentication pages and automatically audits shopping carts, forms, dynamic content and other web applications. as the scan is being completed, the software produces detailed reports that pinp Oint where vulnerabilities exist. Take a product tour or download the evaluation version today!
Scanning for XSS vulnerabilities with Acunetix WVS Free Edition!
To check whether your website has cross site scripting vulnerabilities, download the Free Edition from here. this version will scan any website/web application for XSS vulnerabilities and it will also reveal all the essential information related to it, such as the vulnerability location and remediation techniques. scanning for XSS is normally a quick exercise (depending on the size of the web-site ).
Address: http://www.acunetix.com/websitesecurity/crlf-injection.htm
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
