CRLF-Powered Desync Lets Attackers Poison CDN Cache and Serve XSS to Live Users
Brief
A limited CRLF injection flaw can be escalated into a severe HTTP desynchronization attack, poisoning CDN caches and delivering XSS payloads to users on legitimate websites.
The attack, called CRLF-Powered Desync, begins when an application incorrectly handles encoded carriage return and line feed characters, commonly represented as %0d%0a.
These characters mark new lines in HTTP messages. If a front-end server decodes them before forwarding a request to a backend server, an attacker may inject new HTTP headers or alter the structure of the upstream request.
One risky configuration involves Nginx deployments that place variables such as $uri in proxy_pass directives. Nginx can normalize and URL-decode the path before forwarding it upstream.
CRLF Desync Poisons CDN Caches
This may convert encoded CRLF sequences into actual line breaks, enabling request header injection.