Medium Web Application Scanning Plugin ID 98101
DescriptionHTTP response splitting occurs when untrusted data is inserted into the response
headers without any sanitisation.
If successful, this allows cyber-criminals to essentially split the HTTP response
This is abused by cyber-criminals injecting CR (Carriage Return -- `/r`)
and LF (Line Feed -- `\n`) characters which will then form the split. If the CR
or LF characters are not processed by the server then it cannot be exploited.
Along with these characters, cyber-criminals can then construct their own
arbitrary response headers and body which would then form the second response.
The second response is entirely under their control, allowing for a number of
SolutionIt is recommended that untrusted data is never used to form the contents of the response header.
Where any untrusted source is required to be used in the response headers, it is important to ensure that any hazardous characters (`/r`, `/n` and potentially others) are sanitised prior to being used.
This is especially important when setting cookie values, redirecting, etc..