Vulnerabilities
HTTP Response Splitting
Also known as: CRLF injection in HTTP, HTTP header injection
Definition
An injection vulnerability where untrusted CR/LF characters in user input force the server to emit additional, attacker-controlled HTTP responses.
Examples
- Setting a Location header from a user parameter that contains %0d%0a to inject Set-Cookie.
- Splitting a response so the cache stores an attacker-controlled body for /home.
Related terms
HTTP Request Smuggling
An attack that exploits disagreements between a front-end proxy and a back-end server on how an HTTP request ends, so an attacker can sneak a hidden second request through.
Cache Poisoning
An attack that stores a malicious response in a shared cache so that other users later receive the attacker's content.
Host Header Injection
A vulnerability where an application trusts the HTTP Host (or X-Forwarded-Host) header to build URLs, allowing attackers to redirect users or poison caches.
Cross-Site Scripting (XSS)
A web vulnerability that allows attackers to inject malicious scripts into pages viewed by other users, executing in the victim's browser under the site's origin.
Open Redirect
Open Redirect — definition coming soon.