There is an application which is vulnerable to HTTP Response Header Injection. Here is my observation till now.

If I browse to the URL http://abc.com/abcd/xyz%0d%0aABC , I get a 302 redirection response with following header

HTTP/1.1 302 Found
Date: Thu, xxxxxx
Cache-Control: no-store
Location: https://othersite.com/abcd/xyz

But when I tried to set a cookie value and send a URL which looks like this, http://abc.com/abcd/xyz%0d%0aSet-Cookie%3A%20Cookie=value, this is the response I got,

HTTP/1.1 302 Found
Date: xxxx
Cache-Control: no-store
Location: https://othersite.com/abcd/xyz

Is it exploitable?
What else attack vectors can I try?

Edit: As Sravana asked how abc.com and othersite.com are related, so this request is before login in the application. Login is done via OAuth. Any request made to abc.com is taking the user to othersite.com. Now I think as this is before login, will set-cookie make sense?

  • How are abc.com and othersite.com related ? – Sravan Sep 8 '16 at 15:38
  • 1
    Try setting a cookie value to a session on abc.com you control. Try setting a second Location header (usually defended against). Try setting a content security policy that doesn't allow the redirection. Try finding a redirect on othersite.com that can be fed by this. – Jonah Benton Sep 8 '16 at 16:21
  • @Sravan this request is before login. Login is via OAauth. So any request before login is taking the user to othersite.com. – one Sep 8 '16 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.