PortSwigger shows HTTP header injection can be escalated to a CRLF-powered desync
RESEARCHredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
Researchers at PortSwigger show that a flaw where attackers can insert extra text into web request headers can be made far more dangerous. The attack can send ordinary visitors to a site controlled by the attacker. PortSwigger has added a new check to its scanner to help find this flaw.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Use the newly introduced PortSwigger scan check to test applications for HTTP header injection.
- Read the full PortSwigger article for details of the CRLF desync technique before assessing exposure.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
PortSwigger Research