Which vulnerability involves injecting carriage return and line feed characters into user input to trick the server into treating the input as a new object?

Which vulnerability involves injecting carriage return and line feed characters into user input to trick the server into treating the input as a new object?

• A. CRLF Injection
• B. Broken Authentication
• C. XML External Entity Attack
• D. Insecure Direct Object References

Answer: (A)

CRLF injection happens when attacker-supplied input contains carriage return and line feed characters that are not sanitized. In web applications, input often ends up being placed into HTTP headers or other protocol fields. If the server accepts these characters, it can be tricked into treating part of the input as a new header line or even a new part of the response body. This can lead to HTTP response splitting, header injection, or the creation of unintended objects or entries in logs, effectively altering how the server processes the request and what it returns. This type of vulnerability specifically exploits improper handling of CR and LF characters in user input, which is why it’s labeled CRLF injection. Other options don’t fit this behavior: broken authentication targets how users prove their identity, XML External Entity attacks exploit external entities in XML parsing, and insecure direct object references involve access control around object identifiers rather than manipulating protocol parsing with CRLF characters.

CRLF injection happens when attacker-supplied input contains carriage return and line feed characters that are not sanitized. In web applications, input often ends up being placed into HTTP headers or other protocol fields. If the server accepts these characters, it can be tricked into treating part of the input as a new header line or even a new part of the response body. This can lead to HTTP response splitting, header injection, or the creation of unintended objects or entries in logs, effectively altering how the server processes the request and what it returns. This type of vulnerability specifically exploits improper handling of CR and LF characters in user input, which is why it’s labeled CRLF injection.

Other options don’t fit this behavior: broken authentication targets how users prove their identity, XML External Entity attacks exploit external entities in XML parsing, and insecure direct object references involve access control around object identifiers rather than manipulating protocol parsing with CRLF characters.