Response Splitting

Medium Web Application Scanning Plugin ID 98101


Response Splitting


HTTP response splitting occurs when untrusted data is inserted into the response headers without any sanitisation.

If successful, this allows cyber-criminals to essentially split the HTTP response in two.

This is abused by cyber-criminals injecting CR (Carriage Return -- `/r`) and LF (Line Feed -- `\n`) characters which will then form the split. If the CR or LF characters are not processed by the server then it cannot be exploited.

Along with these characters, cyber-criminals can then construct their own arbitrary response headers and body which would then form the second response. The second response is entirely under their control, allowing for a number of other attacks.


It is recommended that untrusted data is never used to form the contents of the response header.
Where any untrusted source is required to be used in the response headers, it is important to ensure that any hazardous characters (`/r`, `/n` and potentially others) are sanitised prior to being used.
This is especially important when setting cookie values, redirecting, etc..

See Also

Plugin Details

Severity: Medium

ID: 98101

Type: remote

Published: 2017/03/31

Updated: 2017/10/16

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS v3.0

Base Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Reference Information

CWE: 113

WASC: HTTP Response Splitting

OWASP: 2017-A1, 2013-A1, 2010-A1