Practice
HTTP response splitting is a form of web application vulnerability that arises because the application or its environment fails to properly sanitize input values. It can be used to carry out attacks using cross-site scripting, cross-user page hijacking, web cache poisoning, and similar exploits.
The attack results in the server printing a carriage return (CR, ASCII 0x0D) line feed (LF, ASCII 0x0A) sequence followed by content supplied by the attacker in the header section of its response, typically by including them in input fields submitted to the application. According to the HTTP standard (RFC 2616), headers are separated by a single CRLF, and the response headers are separated from its body by two. Consequently, failure to strip CR and LF allows the attacker to set arbitrary headers, gain control over the body, or split the response into two or more separate responses - hence the name.
The general solution is to URL-encode strings before including them in HTTP headers, such as Location or Set-Cookie.
Typical sanitization examples include casting to integers or aggressive replacement using regular expressions. Although response splitting is not specific to PHP, the PHP interpreter has included protection against these attacks since versions 4.4.2 and 5.1.2. [
Comments