4

I'm looking for a vulnerable CRLF environment. So far I've tested PHP and JSP.

In PHP 5.6, header gives you a warning if you try to insert a newline: 

<b>Warning</b>:  Header may not contain more than a single header, new line detected in

In Java 1.8 + Tomcat 7.0.78, response.setHeader replaces the \r\n symbols with spaces.

So, starting from which version did Java and PHP fix the CRLF vulnerability?

Improve this question
2
  • 1
    There are many CRLF injection vulnerabilities. Which one are you referring too?
    – Steffen Ullrich
    Commented Nov 6, 2017 at 8:00
  • @SteffenUllrich the header function in PHP and response.setHeader method in Java
    – daisy
    Commented Nov 6, 2017 at 10:47

2 Answers 2

Reset to default
8

  • PHP - 4.2.1 - CVE - Or see the Anders answer.

  • TOMCAT - Before 6.0.37 / 7.0.30 - CVE

Since CRLF Injection is directly related to HTTP response splitting attacks, I recommend you to read the question I asked, here. The answer was above my expectation.

EDIT

For some reasons, I needed to test some PHP header injections today. @Anders is right, the exploit I linked in the CVE is much more difficult to execute than the exploit stated in his answer below.

Improve this answer
1
  • 3
    The CVE you link to for PHP is related to some more obscure exploit. Up until 5.1.2 you could insert newlines right into the header function. See my answer.
    – Anders
    Commented Nov 6, 2017 at 12:44
4

For PHP, the changelog in the manual for header has the following to say:

5.1.2 This function now prevents more than one header to be sent at once as a protection against header injection attacks.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .