> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/web-attacks/crlf-injection.md). # CRLF Injection Carriage Return (CR) and Line Feed (LF) Injection CRLF injection vulnerabilities occur where improperly sanitized user input is used in a context where newline characters have a semantically important meaning. The carriage return character `CR` (`\r`, `%0D`) moves the cursor to the beginning of the line. The line feed character `LF` (`\n`, `%0A`), moves the cursor down to the next line. ## Tools
CRLFsuiteTool for CRLF injection detection and exploitation.
crlfsuite -t <URL>
## Attacks ### Log Injection Web apps commonly log request details (source IP, path, parameters) for debugging and incident analysis, and security tools like WAFs may log extra data flagged as suspicious. Log Injection happens when user input is written to these logs without sanitizing CRLF characters, letting an attacker forge fake log entries, or escalate further into XSS or RCE if the logs are later rendered or executed (log poisoning). ### HTTP Response Splitting HTTP Response Splitting is a vulnerability that arises when web applications reflect user input in HTTP headers without proper sanitization. Since HTTP headers are separated only by newline characters, injecting a CRLF sequence breaks out of the intended header and lets an attacker append arbitrary HTTP headers or manipulate the response, which can lead to reflected XSS. Furthermore, injecting enough CRLF sequences can terminate the response entirely and write a second, fully attacker-controlled response into the same TCP connection. This second response stays queued and can end up being served to a different, later request on the same connection.
Example Injecting into a redirect’s `Location` header.\ The injected payload must include a correct `Content-Length` for the second response, so it is parsed as a complete, valid response on its own. ```http HTTP/1.1 302 Found Location: http://test.com Content-Length: 0 HTTP/1.1 200 OK Content-Type: text/html Content-Length: 38 ```
{% hint style="info" %} **Escalation:** [**Web Cache Poisoning**](/rednote/pentesting-process/web-attacks/web-cache-poisoning.md)\ Response splitting alone is hard to deliver reliably. Combined with web cache poisoning, the queued injected response can be cached against an unrelated request (e.g. a static file), serving the malicious payload to every visitor of that URL. {% endhint %} ### SMTP Header Injection SMTP Header Injection is a vulnerability that enables attackers to inject email headers. In many cases, user input is reflected in email headers, such as the subject line or sender address. This can lead to CRLF injection attacks if user input is not properly sanitized. A common technique is to inject themselves as a recipient via the `To`, `Cc`, or `Bcc` headers. If the email arrives, the injection succeeded. This isn’t guaranteed to work, though. In SMTP, actual delivery is controlled by the `RCPT TO` command, not by the `To`/`Cc`/`Bcc` headers inside the message body, those are just display fields. The attack only succeeds if the vulnerable application reads back the (now-injected) headers it just built and issues an extra `RCPT TO` for each one. If recipients are instead determined independently before the headers are generated, the injected header is just inert text, and the attacker receives nothing.
Example {% code overflow="wrap" %} ``` From: webmaster@smtpinjection.com To: admin@smtpinjection.com Cc: anotherrecipient@test.com Date: Thu, 26 Oct 2023 13:10:50 +0200 Subject: Testmail Lorem ipsum dolor sit amet, consectetur adipisici elit, sed eiusmod tempor incidunt ut labore et dolore magna aliqua. ``` {% endcode %}
{% hint style="info" %} If trailing text gets appended after the injection point, add a dummy header right after the payload. {% endhint %}