Detections
Analytics
CGI Generic Header Injection
medium Nessus Plugin ID 39468
Language:
Synopsis
The remote web server is prone to HTTP headers injections attacks.Description
The remote web server hosts CGIs that are vulnerable to 'header injection'. By leveraging this issue, an attacker may be able to poison a proxy cache, or trigger a cross-site scripting flaws and cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site.Privilege escalation may be possible too, depending on the application.
Solution
Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade to address any HTTP header injection vulnerabilities.See Also
https://en.wikipedia.org/wiki/HTTP_header_injection
http://projects.webappsec.org/w/page/13246931/HTTP%20Response%20Splitting
Plugin Details
Severity: Medium
ID: 39468
File Name: torture_cgi_header_injection.nasl
Version: 1.26
Type: remote
Family: CGI abuses
Published: 6/19/2009
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests