Name HTTP Response Smuggling
Summary An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To do this, it takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, it might use different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, apparent defacement of targeted sites, cache poisoning, or similar actions.
Prerequisites The targeted server must allow the attacker to insert content that will appear in the server's response.
Solutions Design: Employ strict adherence to interpretations of HTTP messages wherever possible. Implementation: Encode header information provided by user input so that user-supplied content is not interpreted by intermediaries.
Related Weaknesses
CWE ID Description
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-436 Interpretation Conflict
Back to Top