My J2EE application is vulnerable to HTTP header injection attack. I want to make it secure from this vulnerability. Also, I am searching if any library (Maven dependency) available for this.
1 Answer
I think that implementing a library for specifically 1 vulnerability like this, which has an easy fix, is overkill.
Is user input from the headers necessary? If not, then eliminate it.
If user input from the headers is necessary, can you whitelist this input?
If you cannot whitelist the input, can you sanitize the input by stripping newline (i.e. %0d%0a, \r\n) characters?
If you cannot strip newline characters, can you escape them?
If all above fails, you should look into a WAF solution.