Part of HTTP request that should be sent to server with Content-Type: multipart/form-data;
looks like:
------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
attacker_controlled
Then this value is included into header of response to another request:
Content-Disposition:attachment; filename="attacker_controlled.html"
I'd want to make HTTP header injection here. How to encode CR/LF characters in mulupart/formdata
so they will appear as CR/LF at server side? How to make HTTP header injection here if it's not possible?
Edit: I've tried to change this request per @AndrewSmith's advice but it didn't work:
------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
Content-Transfer-Encoding: base64
YXR0YWNrZXJfY29udHJvbGxlZA==
In resulting HTML in place of attacker_controlled
there is YXR0YWNrZXJfY29udHJvbGxlZA==
(i.e. webserver didn't recognize Content-Transfer-Encoding)
So is there way to encode CR/LF characters?