I found CRLF injection on a site but it doesn't has any login, session or anything or that sort. I wonder if there's any way to prove impact of CRLF injection here.

Something that I think can be done is, an attacker can craft the payload in such a way that it would respond with Location header and user would be redirected to a malicious site. This is called Response Splitting. But I'm not sure if the company would consider this as a vulnerability because user's can only be redirected.

I asked myself if that's the only thing an attacker can do? After sometime I realized XSS can also be perform with response splitting but what would attacker get with XSS as there is no session cookie or anything?

I can't figure out how to show am impact of this, are you aware of any interesting header or anything, any help?

EDIT: I found a broken link to an external site on this same forum and checked for content on wayback.

It says.

Cross-User Defacement: An attacker can make a single request to a vulnerable server that will cause the server to create two responses, the second of which may be misinterpreted as a response to a different request, possibly one made by another user sharing the same TCP connection with the server. This can be accomplished by convincing the user to submit the malicious request themselves, or remotely in situations where the attacker and the user share a common TCP connection to the server, such as a shared proxy server. In the best case, an attacker can leverage this ability to convince users that the application has been hacked, causing users to lose confidence in the security of the application. In the worst case, an attacker may provide specially crafted content designed to mimic the behavior of the application but redirect private information, such as account numbers and passwords, back to the attacker.

But I don't understand it properly, can anyone please explain it in simple words?


It depends on the architecture, but essentially the premise is that you inject a http response inside your response causing there to be two responses in the output queue/buffer. Once the server has sent the first response to you it now has another response ready to go which could be delivered to another user. It is not a predictable behaviour and would require other active users that could be attacked.

Even if the site does not have active content you could attack users via a fake plugin update (flash, f.ex) or perform a CSRF attack against another site or their internal network (change Soho router DNS settings f.ex).

| improve this answer | |

As you know, since the vulnerability is on a static site the impact is very low. However, if it appears to be within the program's scope(if it's a bug bounty, of course), then I definitely would consider reporting it. If you can redirect the victim to an external website then it would seem to be a legitimate issue, in my opinion, even if the site lacks any place for user input. If you were to somehow be able to perform the attack on an admin paired with CSRF, you could possibly force them to PUT, POST, DELETE, etc, if those options are enabled on the website.

I suggest doing some OPTIONS requests to find out if PUT,DELETE, or TRACE is allowed (TRACE is considered a security issue). It could be even more vulnerable since, like you said, it has no cookies, and therefore has no CSRF tokens or sessions.

| improve this answer | |
  • I'm not sure if changing method would work or not because its the first thing in request and my injection is somewhere in the middle. I would probably have to inject an entire thing from top to down that is present in request. – Jack Jan 6 at 15:34
  • @Jack and squelch: I would focus on the issue with the redirect. That effectively makes this an open redirect. This link focuses on the advantage for open redirects for phishing which is likely not applicable here, but it effectively comes down to an abuse of trust which can benefit an attacker (and hurt a website operator) in a few contexts. – Conor Mancone Feb 5 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.