0

Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:

------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"

attacker_controlled

Then this value is included into header of response to another request:

Content-Disposition:attachment; filename="attacker_controlled.html"

I'd want to make HTTP header injection here. How to encode CR/LF characters in mulupart/formdata so they will appear as CR/LF at server side? How to make HTTP header injection here if it's not possible?

Edit: I've tried to change this request per @AndrewSmith's advice but it didn't work:

------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
Content-Transfer-Encoding: base64

YXR0YWNrZXJfY29udHJvbGxlZA==

In resulting HTML in place of attacker_controlled there is YXR0YWNrZXJfY29udHJvbGxlZA== (i.e. webserver didn't recognize Content-Transfer-Encoding)

So is there way to encode CR/LF characters?

Improve this question
  • Could you simply post your full request and full response you got now and tell what is the expected response? – Andrew Smith Jul 15 '12 at 12:14
  • @AndrewSmith What info do you need besides of already provided? Full HTTP request and response are too long – Andrei Botalov Jul 15 '12 at 17:03
  • I can't tell if you're trying to figure out how to attack some existing system, or if you're trying to figure out how to defend your system. The answers will differ according to your goal (attack or defense). – D.W. Jul 15 '12 at 22:30
3

How are newlines a problem when there is a boundary defined? The thing with this kind of HTTP packet is that it's binary safe, meaning that the entire 0..255 ASCII range can be used with no problem; including newlines and carriage returns. As long as the specified boundary is not encountered, the server or browser will simply see the characters as part of the data and not as any separator.

Only if an attacker can control the name in the content-disposition header, you would need to strip newlines there. Or if he can guess the boundary to be used, you should make sure the boundary is dynamic or is simply stripped.

Improve this answer
  • 1
    +1 you are correct, this is only a problem if he was building the header. – rook Jul 15 '12 at 18:06
-1

It's 7bit encoding I believe: http://msdn.microsoft.com/en-us/library/ms526290(v=exchg.10).aspx

Please correct me if I am wrong.

It can be also whatever server supports: 8bit, etc, you just put a header and see for yourself how it works, and see what Content-Transfer-Encoding you specify as well.

Improve this answer
  • So is it possible to encode CR/LF characters? – Andrei Botalov Jul 9 '12 at 18:24
  • Yes it is, but depends on the encoding format you've got. – Andrew Smith Jul 9 '12 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.