CRLF Header Injection Flaws Enable HTTP Request Smuggling and Cookie Theft
Brief
A newly disclosed CRLF header injection vulnerability, often treated as a low-impact flaw, can be exploited to enable HTTP request smuggling, response queue poisoning, cross-site scripting, and session cookie theft.
Tom Stacey demonstrates that differences in how proxies, CDNs, and backend applications parse HTTP traffic can transform an injected newline into a critical desynchronization vulnerability.
CRLF, short for carriage return and line feed, is the character sequence used to separate headers in HTTP messages.
CRLF Header Injection Flaws
If an application permits an attacker to introduce encoded CRLF characters, such as %0d%0a , into an input that is later decoded by a reverse proxy, the attacker may be able to alter the structure of the request forwarded to an upstream server.
The research identifies Nginx configurations as a notable risk area.