Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:

------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"

attacker_controlled

Then this value is included into header of response to another request:

Content-Disposition:attachment; filename="attacker_controlled.html"

I'd want to make HTTP header injection here. How to encode CR/LF characters in mulupart/formdata so they will appear as CR/LF at server side? How to make HTTP header injection here if it's not possible?

Edit: I've tried to change this request per @AndrewSmith's advice but it didn't work:

------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
Content-Transfer-Encoding: base64

YXR0YWNrZXJfY29udHJvbGxlZA==

In resulting HTML in place of attacker_controlled there is YXR0YWNrZXJfY29udHJvbGxlZA== (i.e. webserver didn't recognize Content-Transfer-Encoding)

So is there way to encode CR/LF characters?

share|improve this question
    
Could you simply post your full request and full response you got now and tell what is the expected response? –  Andrew Smith Jul 15 '12 at 12:14
    
@AndrewSmith What info do you need besides of already provided? Full HTTP request and response are too long –  Andrey Botalov Jul 15 '12 at 17:03
    
I can't tell if you're trying to figure out how to attack some existing system, or if you're trying to figure out how to defend your system. The answers will differ according to your goal (attack or defense). –  D.W. Jul 15 '12 at 22:30
add comment

2 Answers

up vote 3 down vote accepted

How are newlines a problem when there is a boundary defined? The thing with this kind of HTTP packet is that it's binary safe, meaning that the entire 0..255 ASCII range can be used with no problem; including newlines and carriage returns. As long as the specified boundary is not encountered, the server or browser will simply see the characters as part of the data and not as any separator.

Only if an attacker can control the name in the content-disposition header, you would need to strip newlines there. Or if he can guess the boundary to be used, you should make sure the boundary is dynamic or is simply stripped.

share|improve this answer
1  
+1 you are correct, this is only a problem if he was building the header. –  Rook Jul 15 '12 at 18:06
add comment

It's 7bit encoding I believe: http://msdn.microsoft.com/en-us/library/ms526290(v=exchg.10).aspx

Please correct me if I am wrong.

It can be also whatever server supports: 8bit, etc, you just put a header and see for yourself how it works, and see what Content-Transfer-Encoding you specify as well.

share|improve this answer
    
So is it possible to encode CR/LF characters? –  Andrey Botalov Jul 9 '12 at 18:24
    
Yes it is, but depends on the encoding format you've got. –  Andrew Smith Jul 9 '12 at 20:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.