CWE-93: Failure to Sanitize CRLF Sequences ('CRLF Injection')
Failure to Sanitize CRLF Sequences ('CRLF Injection')
Weakness ID: 93 (Weakness Base)
Status: Draft
Description
Description Summary
The software uses CRLF (carriage return line feeds) as a
special element, e.g. to separate lines or records, but it does not properly
sanitize CRLF sequences from inputs.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Demonstrative Examples
Example 1
If user input data that eventually makes it to a log message isn't
checked for CRLF characters, it may be possible for an attacker to forge
entries in a log file.
(Bad Code)
Java
logger.info("User's street address: " +
request.getParameter("streetAddress"));
Description
