CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger demonstrates that CRLF injection in HTTP headers can be weaponised into full HTTP desync attacks, fundamentally reframing header injection as a critical vulnerability class.
Summary written by editorial AI · Source link below
Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power
Editorial Analysis
Organisations that have deprioritised HTTP header injection as low-severity need to reassess — when chained with desync techniques, it can bypass WAFs and compromise backend systems.
Re-classify CRLF/header injection findings in your vulnerability management system and prioritise remediation of exposed HTTP header construction paths.
HTTP header injection, long considered low-risk, can now be weaponised into attacks that bypass web application firewalls and compromise backend infrastructure.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at PortSwigger Research in a new tab.
More from the Research Desk
- Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication3d
- Not Where You Think: Protecting Location Privacy Against Reasoning-Based Geolocation4d
- Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure4d
- Practical Auditing of Differentially Private Graph Release Mechanisms: Methodology, Toolkit, and Case Study4d
- SecLog-Bench: A Scalable Benchmark for Cybersecurity Log Reasoning with Scaffolded Evidence4d