CRLF Injection
MediumCRLF Injection / HTTP Response Splitting
Definition
CRLF Injection occurs when an attacker can inject carriage-return (\r) and line-feed (\n) characters into the HTTP response headers. This lets them split the HTTP response, inject arbitrary headers, set malicious cookies or even inject HTML/JavaScript content into the response body.
Impact
Injection of arbitrary HTTP headersSetting malicious cookies (session fixation)Cross-Site Scripting (XSS) through injection into the response bodyWeb cache poisoningBypassing security policies (CSP, CORS)
Examples
CRLF Injection to inject a Set-Cookie header
By injecting %0d%0a (URL-encoded CRLF) into the parameter, the attacker can add arbitrary HTTP headers such as Set-Cookie, potentially fixing a session or setting malicious cookies.
# Legitimate URL with a redirect parameter GET /redirect?url=/dashboard HTTP/1.1 # CRLF payload GET /redirect?url=%0d%0aSet-Cookie:%20admin=true%0d%0a HTTP/1.1 # Server response: HTTP/1.1 302 Found Location: /dashboard Set-Cookie: admin=true