How to encode letters in multipart/form-data to include CR/LF characters?

Question

Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:

------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"

attacker_controlled

Then this value is included into header of response to another request:

Content-Disposition:attachment; filename="attacker_controlled.html"

I'd want to make HTTP header injection here. How to encode CR/LF characters in mulupart/formdata so they will appear as CR/LF at server side? How to make HTTP header injection here if it's not possible?

Edit: I've tried to change this request per @AndrewSmith's advice but it didn't work:

------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
Content-Transfer-Encoding: base64

YXR0YWNrZXJfY29udHJvbGxlZA==

In resulting HTML in place of attacker_controlled there is YXR0YWNrZXJfY29udHJvbGxlZA== (i.e. webserver didn't recognize Content-Transfer-Encoding)

So is there way to encode CR/LF characters?

Answer 1

How are newlines a problem when there is a boundary defined? The thing with this kind of HTTP packet is that it's binary safe, meaning that the entire 0..255 ASCII range can be used with no problem; including newlines and carriage returns. As long as the specified boundary is not encountered, the server or browser will simply see the characters as part of the data and not as any separator.

Only if an attacker can control the name in the content-disposition header, you would need to strip newlines there. Or if he can guess the boundary to be used, you should make sure the boundary is dynamic or is simply stripped.

Answer 2

It's 7bit encoding I believe: http://msdn.microsoft.com/en-us/library/ms526290(v=exchg.10).aspx

Please correct me if I am wrong.

It can be also whatever server supports: 8bit, etc, you just put a header and see for yourself how it works, and see what Content-Transfer-Encoding you specify as well.