hunting-crlf-and-response-splitting

Hunting CRLF and response splitting: when a newline becomes a new header

Headers, log lines, and email headers are all line-oriented: a carriage return and line feed ends one field and begins the next. When untrusted input flows into one of these unescaped, an attacker who supplies a CRLF sequence stops writing a value and starts writing structure. A newline in a redirect location injects a header, or a blank line followed by a body splits the response into a second one the attacker controls. A newline in a log line forges an entry that frames another user or hides an action. A newline in a mail header adds recipients or spoofs fields. The bug is not the input; it is a writer that concatenates untrusted text into a line-structured format without rejecting the line terminators. You find these by locating every header, log, and email write fed request data and checking whether CR and LF survive.

When to use

• Request input flows into a response header value: a Set-Cookie, a Location redirect, or a custom header.
• Log lines are written from request data (paths, user agents, identifiers) without neutralizing newlines.
• Outbound email headers (recipients, subject, from, reply-to) are built from user-supplied input.

Scope check

Test CRLF injection only against systems you own or are authorized to assess, on non-production infrastructure, using benign markers rather than live cache-poisoning or spoofed mail when you confirm. A confirmed split can affect other users through a shared cache, so keep every probe within the authorized scope and prefer an isolated instance. If you can't name the authorization, stop.

The loop

1. Establish whether the writer rejects CR and LF first. For each header, log, and email sink, determine whether the runtime or framework already forbids carriage returns and line feeds in the value, or whether a hand-built string or a permissive stack passes them through. This is the false-positive killer: most modern header APIs reject bare CR and LF, so an injected newline never reaches the wire, while a manually-assembled header or an older interface may not. Name the writer's behavior before crafting input.