HTTP response splitting is a form of
web application vulnerability, resulting from the failure of the application or its environment to properly sanitize input values. It can be used to perform
cross-site scripting attacks, cross-user defacement,
web cache poisoning, and similar
exploits.
The attack consists of making the server print a
carriage return (CR,
ASCII )
line feed (LF, ASCII ) sequence followed by content supplied by the attacker in the
header section of its response, typically by including them in input fields sent to the application. Per the
HTTP standard (RFC 2616), headers are separated by one CRLF and the response's headers are separated from its body by two. Therefore, the failure to remove CRs and LFs allows the attacker to set arbitrary headers, take control of the body, or break the response into two or more separate responses—hence the name.
Prevention
The generic solution is to
URL-encode strings before inclusion into
HTTP header
The Hypertext Transfer Protocol (HTTP) is an application layer protocol in the Internet protocol suite model for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web, w ...
s such as ''Location'' or ''Set-Cookie''.
Typical examples of sanitization include
casting
Casting is a manufacturing process in which a liquid material is usually poured into a mold, which contains a hollow cavity of the desired shape, and then allowed to solidify. The solidified part is also known as a ''casting'', which is ejected ...
to
integer
An integer is the number zero (), a positive natural number (, , , etc.) or a negative integer with a minus sign ( −1, −2, −3, etc.). The negative numbers are the additive inverses of the corresponding positive numbers. In the language ...
s or aggressive
regular expression
A regular expression (shortened as regex or regexp; sometimes referred to as rational expression) is a sequence of characters that specifies a search pattern in text. Usually such patterns are used by string-searching algorithms for "find" ...
replacement. Although response splitting is not specific to
PHP
PHP is a General-purpose programming language, general-purpose scripting language geared toward web development. It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995. The PHP reference implementati ...
, the PHP interpreter contains protection against the attack since version 4.4.2 and 5.1.2.
References
External links
Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics. Amit Klein, 2004.Target Web Application Vulnerable to HTTP Header InjectionHTTP Response Splitting, The Web Application Security ConsortiumWapiti Open Source XSS, Header, SQL and LDAP injection scannerLWN article*
/cwe.mitre.org/data/definitions/113.html CWE-113: Failure to Sanitize CRLF Sequences in HTTP Headers ('HTTP Response Splitting')HTTP Response Splitting Attack - OWASPCRLF Injection - OWASP
Web security exploits
Hypertext Transfer Protocol headers
{{web-stub