CVE-2016-5699

CRLF Injection Vulnerability in urllib2 and urllib

• CVSS 6.1
• CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
• Input Validation and Sanitization
• Remote

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

CVE

CVE-2016-5699

CWE

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSS base score

6.1

Published

2016-09-02

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Upgrade to Python 2.7.10 or 3.4.4 or newer versions.

class HTTPConnection:
    def putheader(self, header, value):
        print(f"{header}: {value}")

if __name__ == "__main__":
    connection = HTTPConnection()

    connection.putheader("Content-Type", "application/json")
    
    connection.putheader("X-Custom-Header", "value\r\nExample-Header: example")

import urllib.parse

class HTTPConnection:
    def putheader(self, header, value):
        if '\r' in header or '\n' in header or '\r' in value or '\n' in value:
            raise ValueError("Invalid header or value: CRLF injection attempt detected.")
        print(f"{header}: {value}")

if __name__ == "__main__":
    connection = HTTPConnection()

    try:
        connection.putheader("Content-Type", "application/json")
        
        connection.putheader("X-Custom-Header", "value\r\nExample-Header: example")
    except ValueError as e:
        print("Error:", e)

@misc{vaitp:cve20165699,
  title        = {{CRLF Injection Vulnerability in urllib2 and urllib}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2016},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2016-5699},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-5699/}}
}