Fallos del tipo CWE-113

114 resultados

Injeção de quebras de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada e os insere diretamente em cabeçalhos HTTP sem remover ou neutralizar caracteres CR (retorno de carro) e LF (quebra de linha). Um atacante pode injetar esses caracteres para quebrar o cabeçalho, adicionar cabeçalhos falsos ou até induzir resposta vazia, permitindo ataques como HTTP Response Splitting e Cache Poisoning.

Ejemplo

Um aplicativo web redireciona o usuário com `Location: /page?user=` + input do usuário. Se o usuário entra `attacker.com%0d%0aSet-Cookie:admin=true`, os caracteres %0d%0a (CR+LF) criam um novo cabeçalho, injetando um cookie malicioso na resposta HTTP.

Cómo mitigar

Valide e sanitize toda entrada antes de inserir em cabeçalhos: remova ou rejeite caracteres CR (\r) e LF (\n). Use funções seguras da linguagem (ex: em Java, frameworks como Spring já filtram por padrão) e implemente whitelist de caracteres permitidos para valores de cabeçalho.

CVE-2024-54021MEDIUMAn Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 tEPSS 0.8%CVE-2023-0508LOWImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLabEPSS 0.8%CVE-2023-32708HIGHHTTP Response Splitting via the ‘rest’ SPL CommandEPSS 0.7%CVE-2024-40324CRITICALA CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fielEPSS 0.7%CVE-2022-3215HIGHNIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1EPSS 0.7%CVE-2026-90819MEDIUMa2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splittingEPSS 0.7%CVE-2022-20772MEDIUMA vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attackEPSS 0.7%CVE-2026-105324CRITICALAn HTTP header injection vulnerability was found in the ADMEPSS 0.7%CVE-2024-23644MEDIUMtrillium-http and trillium-client vulnerable to HTTP Request/Response SplittingEPSS 0.6%CVE-2025-41234MEDIUMRFD Attack via “Content-Disposition” Header Sourced from RequestEPSS 0.6%CVE-2017-7528MEDIUMAnsible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For headEPSS 0.6%CVE-2023-26142MEDIUMAll versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header EPSS 0.6%CVE-2026-75419HIGHgo-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/service/internal/dataEPSS 0.5%CVE-2026-77360MEDIUMoRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS BypassEPSS 0.5%CVE-2024-42487MEDIUMCilium's Gateway API route matching order contradicts specificationEPSS 0.5%CVE-2026-50269LOWAIOHTTP: CRLF injection in multipart headersEPSS 0.5%CVE-2021-40336MEDIUMHTTP Response Splitting in Hitachi Energy’s MSM ProductEPSS 0.5%CVE-2022-42471MEDIUMAn improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 tEPSS 0.5%CVE-2026-50576MEDIUMePA 3.x Integration: HTTP Header Injection in VAU Inner RequestsEPSS 0.5%CVE-2026-85077HIGHSanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responsesEPSS 0.5%