40003—CRLF Injection

PUBLISHEDsecurity alertMedium

Active

Metadata

Alert ID:: 40003
Risk:: Medium
Type:: Active
CWE:: CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

摘要

Cookie can be set via CRLF injection. It may also be possible to set arbitrary HTTP response headers. In addition, by carefully crafting the injected response using cross-site script, cache poisoning vulnerability may also exist.

解决方案

Type check the submitted parameter carefully. Do not allow CRLF to be injected by filtering CRLF.

参考

browse all alerts