HTTP Response splitting in case of java

Question

Is HTTP Response splitting possible in below case:

String requestFilename = request.getParameter("name");

response.addHeader("content-disposition", "attachment; filename=" + requestFilename);

I am directly appending the unsanitized request parameter to the reponse header.

My Question is that by using CRLF characters can we insert our own header into response.

So far i have tried \r\n and %0D%0A but they do not work.

Is response.addHeader() immune to such attacks?
Can someone explain it to me how this attack can be executed?

I would assume that addHeader is escaping whatever you pass it. — Jason Sperske
– Jason Sperske, Commented Mar 4, 2015 at 10:11

Nick Holt · Accepted Answer · 2020-01-07 17:04:50Z

1

Whether http response splitting is possible in your case will depend on the servlet container that is hosting the code.

For example, Tomcat guards against common security vunerabilities, with the CORS Filter dealing with response splitting (at least for the incoming request).

Tomcat also filters the values written to the response - see Http11OutputBuffer (line 383), which prevents corrupt values being returned to the client should they somehow end up as a header value.

Never say never, but if you're using an upto date version of popular web-server like Tomcat, you should be safe from well known vunerabilities like response splitting.

answered Jan 7, 2020 at 17:04

Nick Holt

34.5k4 gold badges56 silver badges64 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

HTTP Response splitting in case of java

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related