Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feed) as a special element, e.g. to separate headers or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

CRLF injection can be used to inject malicious headers in HTTP responses (HTTP response splitting), forge log entries, or manipulate other protocols that use CRLF as a delimiter.

Prévalence

Moyenne

3 langages couverts

Impact

Élevé

3 règles de sévérité élevée

Prévention

Documentée

3 exemples de correctifs

2 Prévention

Comment corriger cette vulnérabilité

Stratégies de prévention pour CRLF Injection basées sur 3 règles de détection Shoulder.

🐹 Go Tout voir Go détails →

Email Header Injection HIGH

Validate email addresses and reject input containing CRLF characters

+29 -9 go

  package main
  
  import (
-     "net/http"
-     "net/smtp"
- )
- 
- func handler(w http.ResponseWriter, r *http.Request) {
-     to := r.FormValue("to")
-     subject := r.FormValue("subject")
-     // Vulnerable: user input in email headers without validation
-     msg := []byte("To: " + to + "\r\nSubject: " + subject + "\r\n\r\nBody")
+     "errors"
+     "net/http"
+     "net/mail"
+     "net/smtp"
+     "strings"
+ )
+ 
+ func sanitizeHeader(s string) (string, error) {
+     if strings.ContainsAny(s, "\r\n") {
+         return "", errors.New("invalid characters in header")
+     }
+     return s, nil
+ }
+ 
+ func handler(w http.ResponseWriter, r *http.Request) {
+     to := r.FormValue("to")
+     subject := r.FormValue("subject")
+     // Validate email address
+     if _, err := mail.ParseAddress(to); err != nil {
+         http.Error(w, "Invalid email", 400)
+         return
+     }
+     // Reject CRLF in subject
+     safeSubject, err := sanitizeHeader(subject)
+     if err != nil {
+         http.Error(w, "Invalid subject", 400)
+         return
+     }
+     msg := []byte("To: " + to + "\r\nSubject: " + safeSubject + "\r\n\r\nBody")
      smtp.SendMail("smtp:25", nil, "[email protected]", []string{to}, msg)
  }

🟨 JavaScript Tout voir JavaScript détails →

Email Header Injection HIGH

Validate email addresses and strip CRLF characters from header values

+10 -4 javascript

- app.post('/contact', async (req, res) => {
-   await transporter.sendMail({
-     to: req.body.email,
-     subject: req.body.subject,
+ const validator = require('validator');
+ 
+ app.post('/contact', async (req, res) => {
+   if (!validator.isEmail(req.body.email)) {
+     return res.status(400).json({ error: 'Invalid email' });
+   }
+   const safeSubject = req.body.subject.replace(/[\r\n]/g, '').slice(0, 200);
+   await transporter.sendMail({
+     to: '[email protected]',
+     subject: safeSubject,
      text: req.body.message
    });
  });

🐍 Python Tout voir Python détails →

Email Header Injection HIGH

Strip newline characters from email headers before use

+8 -4 python

  from django.core.mail import send_mail
  
- def contact(request):
-     subject = request.POST.get('subject')
-     send_mail(
-         subject=subject,
+ def sanitize_header(value):
+     return value.replace('\r', '').replace('\n', '')
+ 
+ def contact(request):
+     subject = request.POST.get('subject', '')
+     safe_subject = sanitize_header(subject)
+     send_mail(
+         subject=safe_subject,
          message='Hello',
          from_email='[email protected]',
          recipient_list=['[email protected]']
      )

3 Détection

Trouvez les vulnérabilités dans votre code

Utilisez Shoulder pour scanner votre code à la recherche de patterns Improper Neutralization of CRLF Sequences ('CRLF Injection'). 3 règles.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=93

# Or scan entire project
npx @shoulderdev/cli trust .

Règles de Détection (3)

🐹 Go 1 rules

Email Header Injection HIGH

User input flows into email headers without CRLF validation.

🟨 Javascript 1 rules

Email Header Injection HIGH

Detects email header injection vulnerabilities where user input flows into email headers (To, From, Subject, Cc, Bcc) without validation. Attackers can inject CRLF sequences (\r\n) to add arbitrary headers or body content. Attack impact: - Send spam/phishing emails via your server - Add hidden recipients (Cc/Bcc injection) - Modify email content - Bypass spam filters using your domain reputation Common vulnerable patterns: - nodemailer with user-controlled options - SendGrid/Mailgun APIs with

🔷 Typescript 1 rules

Email Header Injection HIGH

🐍 Python 1 rules

Email Header Injection HIGH

Detects user input used in email headers without newline sanitization.

4 Signes d'Alerte

Ce qu'il faut surveiller lors des revues de code

Ces patterns indiquent des vulnérabilités potentielles Improper Neutralization of CRLF Sequences ('CRLF Injection'). Recherchez-les lors des revues de code et des audits de sécurité.

🟠

email header injection vulnerabilities where user input flows into email headers (To, From, Subject, javascript-email-header-injection

🟠

user input used in email headers without newline sanitization python-email-injection

🔍

Scannez votre base de code pour Improper Neutralization of CRLF Sequences ('CRLF Injection')

Shoulder CLI trouve les motifs vulnérables dans toute votre base de code.

npx shoulder trust Parcourir toutes les règles