HTTP response splitting / CRLF injection into HTTP headers

ID

vbnet.inject.http_splitting

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

User-controlled input flows into an HTTP response header without neutralizing CR/LF characters, which may allow HTTP response splitting: an attacker who injects %0d%0a can add arbitrary headers or a second response (enabling cache poisoning, XSS or session fixation). Strip CR/LF (or URL-encode) the value, or rely on the framework header APIs that reject line breaks.

Rationale

User-controlled input flows into an HTTP response header without neutralizing CR/LF characters, which may allow HTTP response splitting: an attacker who injects %0d%0a can add arbitrary headers or a second response (enabling cache poisoning, XSS or session fixation). Strip CR/LF (or URL-encode) the value, or rely on the framework header APIs that reject line breaks.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub AddHeaderDirect()
    ' VULNERABLE: HTTP response splitting / CRLF injection into HTTP headers
    Response.AddHeader("X-Custom", Request.QueryString("h"))
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References