2

I was pen-testing a site recently which I found a few issues in, and this continues to a previous question I asked about Null-byte string termination in web applications.

I have noticed that the site does not filter out URL Encoded CR/LF characters, and if I inject these characters, they do get respected in the source code (you can see the code gets shifted down in the page).

I have checked the returning headers, but there is no sign of any data which I try to inject, also any XSS characters I do inject get filtered (html entities) by the page ('<' => &lt;, etc)

So my question is, is this CRLF injection potentially exploitable?

Thanks!

Improve this question

1 Answer 1

Reset to default
1

If your CRLF output shows in response header, it's vulnerable and exploitable (even if < > " chars is filterd) .

An attacker can use to set-cookie header for session-fixation attacks, or using to location and cache in headers and ... .

update

If your output is in html body it's not exploitable,CR LF Characters in HTML are white spaces . But if it's in javascript it could be explitable .

Improve this answer
2
  • 1
    Sure, I understand how CRLF injection usually works, but as this is not being injected into the headers, it's a strange one.
    – DarkMantis
    Sep 25, 2013 at 8:13
  • 2
    it's not exploitable,CR LF Characters in HTML body are white spaces . But if output is in javascript it's exploitable .
    – Sajjad Pourali
    Sep 25, 2013 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.