275
An attacker can make a single request to a vulnerable server that will cause the server to create
two responses, the second of which may be misinterpreted as a response to a different request,
possibly one made by another user sharing the same TCP connection with the server.
Cross-User Defacement can be accomplished by convincing the user to submit the malicious
request themselves, or remotely in situations where the attacker and the user share a common
TCP connection to the server, such as a shared proxy server.
• In the best case, an attacker can leverage this ability to convince users that the application
has been hacked, causing users to lose confidence in the security of the application.
• In the worst case, an attacker may provide specially crafted content designed to mimic the
behavior of the application but redirect private information, such as account numbers and
passwords, back to the attacker.
Example 3:
The impact of a maliciously constructed response can be magnified if it is cached, either by a web
cache used by multiple users or even the browser cache of a single user.
Cache Poisoning: if a response is cached in a shared web cache, such as those commonly found
in proxy servers, then all users of that cache will continue receive the malicious content until the
cache entry is purged. Similarly, if the response is cached in the browser of an individual user, then
that user will continue to receive the malicious content until the cache entry is purged, although the
user of the local browser instance will be affected.
Example 4:
Once attackers have control of the responses sent by an application, they have a choice of a
variety of malicious content to provide users.
Cross-Site Scripting: cross-site scripting is common form of attack where malicious JavaScript or
other code included in a response is executed in the user's browser.
The variety of attacks based on XSS is almost limitless, but they commonly include transmitting
private data like cookies or other session information to the attacker, redirecting the victim to web
content controlled by the attacker, or performing other malicious operations on the user's machine
under the guise of the vulnerable site.
The most common and dangerous attack vector against users of a vulnerable application uses
JavaScript to transmit session and authentication information back to the attacker who can then
take complete control of the victim's account.
Example 5:
In addition to using a vulnerable application to send malicious content to a user, the same
weakness can also be leveraged to redirect sensitive content generated by the server to the
attacker instead of the intended user.
Page Hijacking: by submitting a request that results in two responses, the intended response from
the server and the response generated by the attacker, an attacker can cause an intermediate
node, such as a shared proxy server, to misdirect a response generated by the server to the
attacker instead of the intended user.
Because the request made by the attacker generates two responses, the first is interpreted as a
response to the attacker's request, while the second remains in limbo. When the user makes a
legitimate request through the same TCP connection, the attacker's request is already waiting and
is interpreted as a response to the victim's request. The attacker then sends a second request to
the server, to which the proxy server responds with the server generated request intended for the
CWE Version 4.14
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response
Splitting')
CWE-113: Improper Neutralization of CRLF Sequences
in HTTP Headers ('HTTP Request/Response Splitting') 276
victim, thereby compromising any sensitive information in the headers or body of the response
intended for the victim.
Observed Examples
Reference Description
CVE-2020-15811 Chain: Proxy uses a substring search instead of parsing the Transfer-Encoding
header (CWE-697), allowing request splitting (CWE-113) and cache poisoning
https://www.cve.org/CVERecord?id=CVE-2020-15811
CVE-2021-41084 Scala-based HTTP interface allows request splitting and response splitting
through header names, header values, status reasons, and URIs
https://www.cve.org/CVERecord?id=CVE-2021-41084
CVE-2018-12116 Javascript-based framework allows request splitting through a path option of
an HTTP request
https://www.cve.org/CVERecord?id=CVE-2018-12116
CVE-2004-2146 Application accepts CRLF in an object ID, allowing HTTP response splitting.
https://www.cve.org/CVERecord?id=CVE-2004-2146
CVE-2004-1656 Shopping cart allows HTTP response splitting to perform HTML injection via
CRLF in a parameter for a url
https://www.cve.org/CVERecord?id=CVE-2004-1656
CVE-2005-2060 Bulletin board allows response splitting via CRLF in parameter.
https://www.cve.org/CVERecord?id=CVE-2005-2060
CVE-2004-2512 Response splitting via CRLF in PHPSESSID.
https://www.cve.org/CVERecord?id=CVE-2004-2512
CVE-2005-1951 e-commerce app allows HTTP response splitting using CRLF in object id
parameters
https://www.cve.org/CVERecord?id=CVE-2005-1951
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER HTTP response splitting
7 Pernicious Kingdoms HTTP Response Splitting
WASC 25 HTTP Response Splitting
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
31 Accessing/Intercepting/Modifying HTTP Cookies
34 HTTP Response Splitting
85 AJAX Footprinting
105 HTTP Request Splitting
References
[REF-43]OWASP. "OWASP TOP 10". 2007 May 8. < https://github.com/owasp-top/owasp-top-2007
>.
CWE Version 4.14
CWE-114: Process Control
CWE-114: Process Control