CWE-93 对CRLF序列的转义处理不恰当（CRLF注入）

Improper Neutralization of CRLF Sequences ('CRLF Injection')

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 74 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 74 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: CanPrecede cwe_CWE_ID: 117 cwe_View_ID: 1000

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Integrity Modify Application Data

可能的缓解方案

Implementation

策略:

Avoid using CRLF as a special sequence.

Implementation

策略:

Appropriately filter or quote CRLF sequences in user-controlled input.

示例代码

例

If user input data that eventually makes it to a log message isn't checked for CRLF characters, it may be possible for an attacker to forge entries in a log file.

bad Java

logger.info("User's street address: " + request.getParameter("streetAddress"));

分析过的案例

标识 说明 链接
CVE-2002-1771 CRLF injection enables spam proxy (add mail headers) using email address or name. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1771
CVE-2002-1783 CRLF injection in API function arguments modify headers for outgoing requests. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1783
CVE-2004-1513 Spoofed entries in web server log file via carriage returns https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1513
CVE-2006-4624 Chain: inject fake log entries with fake timestamps using CRLF injection https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4624
CVE-2005-1951 Chain: Application accepts CRLF in an object ID, allowing HTTP response splitting. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1951
CVE-2004-1687 Chain: HTTP response splitting via CRLF in parameter related to URL. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1687

Notes

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER CRLF Injection
OWASP Top Ten 2007 A2 CWE More Specific Injection Flaws
WASC 24 HTTP Request Splitting
Software Fault Patterns SFP24 Tainted input to command

相关攻击模式

  • CAPEC-15
  • CAPEC-81

引用