Re:HTTP Response Splitting Vulnerability on reddit.com
by axod on Saturday January 15, 2011 @06:58PM
(#2108156)
> "The attack is trivial to prevent; just don't allow newlines (and, ideally, active HTML characters) in redirect content."
Surely the more correct solution is to escape them properly.
eg in the example:
Location: javascript:
<script>alert(document.cookie)</script>
Location: javascript:%0D%0A%0D%0A<script>alert(document.cookie)</script>
The vulnerability in response-splitting is passing attacker-controlled newlines unmolested through HTTP header content. Newlines terminate headers. Attacker-controlled content in a redirect that is allowed to contain newlines enables attackers to inject new headers or to terminate the header portion of the request.
Here, Neal's using the attack to inject a false end-of-headers newline and then a fake request body containing Javascript.
The attack is trivial to prevent; just don't allow newlines (and, ideally, active HTML characters) in redirect content.
† The goal of an attacker is to coerce a server into sending her own Javascript; the same-origin rules governing browser security allow that Javascript access to the server's cookies, even though the code is under the control of an attacker.