How to fix security issue "CRLF injection/HTTP response splitting (Web Server)"

2.1k Views Asked by At

After security scan from Acunetix, i got a medium severity alert "CRLF injection/HTTP response splitting (Web Server)". I have filtered all CR LF characters from users input in my website. But still it shows same alert. I don't understand how do i solve this issue or Exact where is the problem? My PHP version is PHP 7 and i'm using Codeigniter 3.14 framework. Screenshot given below. enter image description here

1

There are 1 best solutions below

1
On

This might be helpful to you-

To avoid such HTTP Splitting vulnerabilities parse all user input for CR LF \r\n %0d%0a or any other forms of encoding these or other such malicious characters before using them in any form of HTTP headers. These vulnerabilities can be used to fool their clients and steal authentication information.

Refer- http://www.securiteam.com/securityreviews/5WP0E2KFGK.html