CRLFinjektio

CRLFinjektio, or CRLF injection, is a web security vulnerability that arises when untrusted input is reflected into HTTP response headers without proper encoding or validation. CR and LF refer to carriage return and line feed characters, which can terminate a header and start a new one. When these characters are inadvertently accepted in header values or names, an attacker may craft additional headers or even alter the response body.

The mechanism typically involves user-supplied data that ends up in header-bearing contexts, such as the Location header used for redirects, Set-Cookie headers, or Cache-Control directives. If input is inserted directly into these headers, an attacker can inject new headers or manipulate the response structure. This can lead to HTTP response splitting, which may cause cache poisoning, cross-site scripting in certain configurations, or unexpected redirects and data leakage.

Impact varies with the context and server behavior. In some cases, an attacker can influence how a page is loaded, manipulate caching, or redirect users to malicious sites. The vulnerability is more likely when applications echo user input into HTTP headers or URL-related redirects without strict validation and encoding.

Mitigation focuses on strict input handling and safe header construction. Best practices include validating and sanitizing input, encoding values placed in headers, avoiding direct reflection of user data into header fields, using framework or library features that enforce safe header handling, and configuring servers to reject or neutralize CRLF characters. Regular security testing and input fuzzing can help detect and remediate CRLFinjektio risks. See also HTTP header injection and HTTP response splitting.