Another 1500$: CR/LF Injection

Hi Everyone, How you all doing. Recently, while assessing the security of HuliaHub(Pseudonym of a private bbp), I found a critical CR/LF vulnerability. This marks my second CR/LF injection vulnerability found in this particular program within a month, highlighting the importance of rigorous security testing and patching.

Understanding CR/LF (Carriage Return/Line Feed) Injection

CR/LF (Carriage Return/Line Feed) injection is a type of security vulnerability. CR/LF refers to a sequence of two ASCII control characters: Carriage Return (CR, ASCII code 13) and Line Feed (LF, ASCII code 10). CR/LF injection vulnerabilities occur when attackers insert CR/LF characters into input fields, parameters, file extensions or file uploads to manipulate application behavior. This can lead to exploits such as altering headers, injecting malicious code, or manipulating file content.

Discovery of the Vulnerability

The CR/LF vulnerability found in HuliaHub’s authentication mechanism allows attackers to manipulate the redirect URL parameter during user authentication. This manipulation involves injecting special characters (%0D%0A), commonly used to denote new lines in HTTP headers. This vulnerability enables attackers to perform malicious actions post-authentication.

Reconnaissance and Testing