QwikSec

Security Database

CVE

CWE

Training

CWE Database
/

CWE-93

Back to CWE list

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Base
Draft

Description

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Related Weaknesses

CWE-117 (CanPrecede)

Common Consequences

Scope

Integrity

Impact

Modify Application Data

Potential Mitigations

Implementation

Avoid using CRLF as a special sequence.

Implementation

Appropriately filter or quote CRLF sequences in user-controlled input.

CVE-2002-1771

CRLF injection enables spam proxy (add mail headers) using email address or name.

CVE-2002-1783

CRLF injection in API function arguments modify headers for outgoing requests.

CVE-2004-1513

Spoofed entries in web server log file via carriage returns

CVE-2006-4624

Chain: inject fake log entries with fake timestamps using CRLF injection

CVE-2005-1951

Chain: Application accepts CRLF in an object ID, allowing HTTP response splitting.

CVE-2004-1687

Chain: HTTP response splitting via CRLF in parameter related to URL.

Applicable Platforms

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now