CRLF Injection

  • 警报等级:

  • Medium

  • 警报类型:
  • Active
摘要

Cookie can be set via CRLF injection. It may also be possible to set arbitrary HTTP response headers. In addition, by carefully crafting the injected response using cross-site script, cache poisoning vulnerability may also exist.

解决方案

Type check the submitted parameter carefully. Do not allow CRLF to be injected by filtering CRLF.

参考

https://owasp.org/www-community/vulnerabilities/CRLF_Injection

https://cwe.mitre.org/data/definitions/113.html