CWE-93 (对CRLF序列的转义处理不恰当(CRLF注入)) — Vulnerability Class 151

151 vulnerabilities classified as CWE-93 (对CRLF序列的转义处理不恰当(CRLF注入)). AI Chinese analysis included.

CWE-93 represents a critical input validation weakness where applications fail to properly sanitize Carriage Return and Line Feed characters within user-supplied data. This vulnerability typically enables attackers to inject malicious HTTP headers or split response lines, facilitating attacks such as HTTP response splitting, session fixation, or cross-site scripting. By manipulating these control characters, adversaries can alter the structure of web responses, potentially redirecting users to phishing sites or injecting malicious scripts into the browser context. To mitigate this risk, developers must rigorously validate and sanitize all input fields, specifically filtering out or encoding CRLF sequences before processing. Implementing strict allow-lists for acceptable characters and utilizing framework-provided encoding functions ensures that these control characters are neutralized, thereby preserving the integrity of HTTP headers and preventing unauthorized manipulation of application logic.

MITRE CWE Description

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Common Consequences (1)

Integrity Modify Application Data

Mitigations (2)

Implementation Avoid using CRLF as a special sequence.

Implementation Appropriately filter or quote CRLF sequences in user-controlled input.

Examples (2)

The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.

String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);

Bad · Java

HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...

Result

The following code is a workflow job written using YAML. The code attempts to download pull request artifacts, unzip from the artifact called pr.zip and extract the value of the file NR into a variable "pr_number" that will be used later in another job. It attempts to create a github workflow environment variable, writing to $GITHUB_ENV. The environment …

name: Deploy Preview jobs: deploy: runs-on: ubuntu-latest steps: - name: 'Download artifact' uses: actions/github-script with: script: | var artifacts = await github.actions.listWorkflowRunArtifacts({ owner: context.repo.owner, repo: context.repo.repo, run_id: ${{ github.event.workflow_run.id }}, }); var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => { return artifact.name == "pr" })[0]; var downloadPr = await github.actions.downloadArtifact({ owner: context.repo.owner, repo: context.repo.repo, artifact_id: matchPrArtifact.id, archive_format: 'zip', }); var fs = require('fs');

Bad · Other

\nNODE_OPTIONS="--experimental-modules --experiments-loader=data:text/javascript,console.log('injected code');//"

Attack

CVE ID	Title	CVSS	Severity	Published
CVE-2018-12537	Eclipse Vert.x 安全漏洞 — Eclipse Vert.x	5.3	-	2018-08-14

Vulnerabilities classified as CWE-93 (对CRLF序列的转义处理不恰当(CRLF注入)) represent 151 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.