CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Improper Neutralization of CRLF Sequences ('CRLF Injection')
Weakness ID: 93 (Weakness Base)
Status: Draft
Description
Description Summary
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Integrity
Technical Impact: Modify application
data
Likelihood of Exploit
Medium to High
Demonstrative Examples
Example 1
If user input data that eventually makes it to a log message isn't
checked for CRLF characters, it may be possible for an attacker to forge
entries in a log file.
(Bad Code)
Example
Language: Java
logger.info("User's street address: " +
request.getParameter("streetAddress"));
Description
