This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "CRLF Injection"
Weilin Zhong (talk | contribs) |
(Initial content) |
||
| Line 1: | Line 1: | ||
| − | {{Template: | + | {{Template:Vulnerability}} |
| + | ==Description== | ||
| + | The term CRLF refers to '''C'''arage '''R'''eturn (ASCII 13, \r) '''L'''ine '''F'''eed (ASCII 10, \n). They're used to note the termination of a line, however, dealt with differently in today’s popular Operating Systems. For example: in Windows both a CR and LF are required to note the end of a line, whereas in Linux/UNIX a LF is only required. | ||
| + | |||
| + | A CFLR Injection attack occurs when a user managed to submit a CRLF into an application. This is most commonly done by modifying an HTTP parameter or URL. | ||
| + | |||
| + | ==Impact and Example== | ||
| + | Depending on how the application is developed this can be a minor problem or a fairly serious security flaw. Lets look at the latter because this is after all a security related post. | ||
| + | |||
| + | Lets assume a file is used at some point to read/write data to -likely a log of some sort. If an attacker managed to place a CRLF then can then inject some sort of read programmatic method to the file. This could result in the contents being written to screen on the next attempt to use this file. | ||
| + | |||
| + | ==Categories== | ||
[[Category:Vulnerability]] | [[Category:Vulnerability]] | ||
| − | |||
[[Category:Implementation]] | [[Category:Implementation]] | ||
Revision as of 23:08, 17 August 2006
This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.
Description
The term CRLF refers to Carage Return (ASCII 13, \r) Line Feed (ASCII 10, \n). They're used to note the termination of a line, however, dealt with differently in today’s popular Operating Systems. For example: in Windows both a CR and LF are required to note the end of a line, whereas in Linux/UNIX a LF is only required.
A CFLR Injection attack occurs when a user managed to submit a CRLF into an application. This is most commonly done by modifying an HTTP parameter or URL.
Impact and Example
Depending on how the application is developed this can be a minor problem or a fairly serious security flaw. Lets look at the latter because this is after all a security related post.
Lets assume a file is used at some point to read/write data to -likely a log of some sort. If an attacker managed to place a CRLF then can then inject some sort of read programmatic method to the file. This could result in the contents being written to screen on the next attempt to use this file.
