Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In HTTP response there is the following header with attacker controlled content:

Content-Disposition:attachment; filename="attacker_controlled.html"

The only characters that can't appear in attacker controlled value are [CR] and [LF] (they can't appear in any combination). In all places where I read about HTTP header injection it was told about injecting those characters.

Is it possible to do HTTP header injection or some other harmful attack without CRLF?

share|improve this question
    
If the attacker controlled part is the filename, I'd filter " as well. Filtering \0 (and possibly all codepoints <32) sounds like a good idea too. –  CodesInChaos Jan 6 '13 at 16:43

2 Answers 2

I don't know of any way to do HTTP header injection, under the conditions you mention.

However, there are other risks, such as path traversal attacks, downloading of active content, or overwriting system standard files. I recommend reading RFC 6266, Section 4.3 and RFC 2183, Section 5, which describes some of the risks. (RFC 6266 is the one that defines the Content-Disposition header.) See also this blog post for discussion about XSS risks, if you allow the attacker to control both the filename and the contents of the file.

share|improve this answer

Depends what you mean by stripped. (python's string.strip() method only removes occurrences from the beginning and end, which doesn't stop CRLF injection.) If you are replacing all occurrences "\r\n" then you are still vulnerable to HTTP response splitting. This is because every http client and server I know of also recognizes the "\n" character alone as a delimiter. Although in this case all we care about is browsers.

The best way to always replace all occurrences of newline "\n" with nothing "" and the "\r" with nothing "", separately for good measure. I have never seen an implantation of the HTTP protocol that just looks for "\r", so as far as I know this has zero security impact, but you should do it anyway for good measure. If you are also worried about HTTP attributes then you also need to strip " ", "\"" and ";", but that also depends on where in the http header the attacker controlled string is.

share|improve this answer
    
CR, LF, CRLF etc. can't appear there. Issue about LF was told in Michal Zalewski's Tangled Web. –  Andrey Botalov Jul 13 '12 at 18:20
    
@Andrey Botalov I loved "a tangled web", beautiful book. If you can show me a platform where a cr alone is an issue i'll be impressed. That being said i always filter both for good measure, even though as far as i know the cr has zero security impact. –  Rook Jul 13 '12 at 18:42
    
@Andrey Botalov also if you replace all CR and all LR then CRLF can't exist. That right there is a classic logic error :). –  Rook Jul 13 '12 at 18:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.