PortSwigger shows HTTP header injection can be escalated to a CRLF-powered desync
RESEARCHredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
PortSwigger Research describes escalating HTTP header injection into a CRLF-powered desync, which it says can be used to serve random users a redirect to an attacker's collaborator server. The article says this can be done in a single prompt. PortSwigger has introduced a new scan check to detect the issue, but the excerpt is cut off before further technical detail.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Use the newly introduced PortSwigger scan check to test applications for HTTP header injection.
- Read the full PortSwigger article for details of the CRLF desync technique before assessing exposure.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
PortSwigger Research