I was pen-testing a site recently which I found a few issues in, and this continues to a previous question I asked about Null-byte string termination in web applications.

I have noticed that the site does not filter out URL Encoded CR/LF characters, and if I inject these characters, they do get respected in the source code (you can see the code gets shifted down in the page).

I have checked the returning headers, but there is no sign of any data which I try to inject, also any XSS characters I do inject get filtered (html entities) by the page ('<' => &lt;, etc)

So my question is, is this CRLF injection potentially exploitable?


1 Answer 1


If your CRLF output shows in response header, it's vulnerable and exploitable (even if < > " chars is filterd) .

An attacker can use to set-cookie header for session-fixation attacks, or using to location and cache in headers and ... .


If your output is in html body it's not exploitable,CR LF Characters in HTML are white spaces . But if it's in javascript it could be explitable .

  • 1
    Sure, I understand how CRLF injection usually works, but as this is not being injected into the headers, it's a strange one.
    – DarkMantis
    Commented Sep 25, 2013 at 8:13
  • 2
    it's not exploitable,CR LF Characters in HTML body are white spaces . But if output is in javascript it's exploitable . Commented Sep 25, 2013 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .