Is it possible to do HTTP header injection if CR/LF are stripped?

Question

In HTTP response there is the following header with attacker controlled content:

Content-Disposition:attachment; filename="attacker_controlled.html"

The only characters that can't appear in attacker controlled value are [CR] and [LF] (they can't appear in any combination). In all places where I read about HTTP header injection it was told about injecting those characters.

Is it possible to do HTTP header injection or some other harmful attack without CRLF?

Answer 1

Depends what you mean by stripped. (python's string.strip() method only removes occurrences from the beginning and end, which doesn't stop CRLF injection.) If you are replacing all occurrences "\r\n" then you are still vulnerable to HTTP response splitting. This is because every http client and server I know of also recognizes the "\n" character alone as a delimiter. Although in this case all we care about is browsers.

The best way to always replace all occurrences of newline "\n" with nothing "" and the "\r" with nothing "", separately for good measure. I have never seen an implantation of the HTTP protocol that just looks for "\r", so as far as I know this has zero security impact, but you should do it anyway for good measure. If you are also worried about HTTP attributes then you also need to strip " ", "\"" and ";", but that also depends on where in the http header the attacker controlled string is.

Answer 2

I don't know of any way to do HTTP header injection, under the conditions you mention.

However, there are other risks, such as path traversal attacks, downloading of active content, or overwriting system standard files. I recommend reading RFC 6266, Section 4.3 and RFC 2183, Section 5, which describes some of the risks. (RFC 6266 is the one that defines the Content-Disposition header.) See also this blog post for discussion about XSS risks, if you allow the attacker to control both the filename and the contents of the file.