Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
The product receives data from an HTTP agent/component, and it places this data in HTTP response headers without neutralizing CRLF sequences.
An attacker can inject CRLF sequences into HTTP headers to create additional headers or response body content. This can lead to cache poisoning, cross-site scripting, or other attacks.
How to fix this vulnerability
Prevention strategies for HTTP Response Splitting based on 3 Shoulder detection rules.
Strip CRLF characters from user input before setting HTTP headers
package main - import "net/http" - - func handler(w http.ResponseWriter, r *http.Request) { - lang := r.URL.Query().Get("lang") - // Vulnerable: user input set as header value - w.Header().Set("Content-Language", lang) + import ( + "net/http" + "strings" + ) + + func sanitizeHeaderValue(s string) string { + s = strings.ReplaceAll(s, "\r", "") + s = strings.ReplaceAll(s, "\n", "") + return s + } + + func handler(w http.ResponseWriter, r *http.Request) { + lang := r.URL.Query().Get("lang") + // Safe: CRLF characters stripped + w.Header().Set("Content-Language", sanitizeHeaderValue(lang)) w.Write([]byte("OK")) }
Strip CRLF characters from user input before using in HTTP headers
- from flask import request, make_response - - @app.route('/download') - def download(): - filename = request.args.get('filename') - response = make_response("content") - response.headers['Content-Disposition'] = f'attachment; filename="{filename}"' + import re + from flask import request, make_response + + def sanitize_header(value): + return re.sub(r'[\r\n]', '', str(value)) + + @app.route('/download') + def download(): + filename = request.args.get('filename', '') + safe_filename = sanitize_header(filename) + response = make_response("content") + response.headers['Content-Disposition'] = f'attachment; filename="{safe_filename}"' return response
Find vulnerabilities in your code
Use Shoulder to scan your codebase for Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') patterns. 3 rules.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=113 # Or scan entire project npx @shoulderdev/cli trust .
Detection Rules (3)
What to watch for in code reviews
These patterns indicate potential Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerabilities. Look for these during code reviews and security audits.
Scan your codebase for Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Shoulder CLI finds vulnerable patterns across your entire codebase.