CRLF Injection
CRLF Injection Definition
A carriage return and line feed (CRLF) injection is a web security weakness. It occurs when an application accepts CRLF characters in untrusted input without filtering or encoding them. Because CRLF characters mark line breaks in many text-based protocols, injected values can change how systems interpret HTTP headers, log entries, email headers, or other structured data.
How CRLF Injection Works
CRLF injection happens when an application treats submitted CRLF characters as real line breaks instead of ordinary input. These characters are commonly represented as “\r\n” in programming languages and as “%0d%0a” when URL-encoded. An attacker inserts these characters into a URL parameter, form field, HTTP header, or another input value. If the application copies that value into a response header, log entry, or other structured output, the extra line break can make the system read attacker-supplied text as a separate instruction, header, or record.
Depending on where the input is used, this can result in forged log entries, modified email headers, or HTTP response splitting. Under certain conditions, these issues may contribute to related attacks such as web cache poisoning, cross-site scripting (XSS), certain forms of HTTP request or response smuggling.
What CRLF Injection Can Affect
- HTTP headers: Adds or changes header lines in a response, potentially enabling HTTP response splitting.
- Server logs: Creates fake entries or alters how events appear.
- Email headers: Adds or modifies message headers, potentially affecting message handling.
- Cached content: May contribute to web cache poisoning when combined with HTTP response splitting or other downstream conditions.
How Websites Prevent CRLF Injection
Websites prevent CRLF injection by checking user input before it reaches headers, logs, or other structured output. Developers validate input, remove or encode CRLF characters, and avoid copying untrusted values directly into places where line breaks carry meaning. Modern frameworks may block CRLF characters in some header functions, but applications still need safe input handling.
Read More
FAQ
CRLF stands for carriage return and line feed. These characters mark a line break in many text-based systems. Web protocols, email systems, and log files can use line breaks to separate headers, records, or entries.
CRLF injection happens when an application accepts CRLF characters from untrusted input and places them into structured output. This often affects response headers, logs, or messages that rely on line breaks to separate information.
CRLF injection and HTTP response splitting are related, but they aren’t identical. CRLF injection describes the input weakness. HTTP response splitting describes one possible result when injected CRLF characters change how a browser, proxy, or cache reads an HTTP response. Not every CRLF injection vulnerability leads to HTTP response splitting.
45-Day Money-Back Guarantee