CRLF Injection Enables Desync Attacks, Poisoning CDNs and Delivering XSS
A CRLF injection vulnerability can be exploited to perform HTTP desynchronization attacks, enabling cache poisoning and XSS delivery.
A subtle CRLF injection flaw has been escalated into a potent HTTP desynchronization attack, capable of poisoning Content Delivery Network (CDN) caches and delivering cross-site scripting (XSS) payloads to unsuspecting users on legitimate websites. Dubbed the CRLF-Powered Desync attack, this vulnerability exploits how front-end servers and back-end applications interpret HTTP requests, particularly when systems like Nginx process URL-encoded carriage return and line feed characters (%0d%0a).
At its core, the attack hinges on the improper handling of these encoded characters, which are fundamental to delineating lines within HTTP messages. When a front-end server decodes these sequences before forwarding a request to a back-end server, an attacker can inject new HTTP headers or fundamentally alter the structure of the upstream request. This becomes particularly dangerous in configurations where Nginx uses variables like $uri within its proxy_pass directives, as Nginx may normalize and URL-decode the path, inadvertently converting encoded CRLF characters into actual line breaks.
The consequence of this misinterpretation is an HTTP request smuggling, or desynchronization, condition. This occurs when a front-end proxy and a back-end application disagree on where one HTTP request ends and the next begins. Attackers can exploit this discrepancy to insert an additional, malicious request into a connection that is being shared by multiple users or requests.
This desynchronization can lead to severe security implications, including response queue poisoning. Responses intended for one user might be inadvertently delivered to another, potentially resulting in account mix-ups, exposure of sensitive data like session cookies and authorization tokens, denial of service, or widespread cache poisoning. The researchers demonstrated that this issue can be particularly devastating when it affects CDN infrastructure, leading to the mixing of requests and responses from entirely unrelated websites hosted on the same CDN.
A more impactful scenario involves poisoning a CDN-cached page and transforming it into a vector for XSS attacks. By combining a CRLF-powered CL.TE desync with a specific manipulation of HEAD request behavior, attackers can trick a CDN into caching a malicious response. This poisoned resource can then be served to live users, allowing attacker-controlled JavaScript to execute within their browser context.
Further compounding the risk, these attacks can be browser-compatible. In some instances, normal browser navigation or JavaScript fetch() requests can carry the crafted encoded data necessary to trigger the desync. If an attacker successfully achieves XSS on a victim-facing page, the victim's browser could repeatedly launch these malicious requests, creating a self-propagating "desync worm" that spreads across users.
Security professionals are urged to treat CRLF injection and request header injection vulnerabilities with high severity, rather than dismissing them as minor input validation issues. Mitigation strategies include rigorous review of reverse-proxy configurations, avoiding the use of decoded URI variables in critical Nginx directives, and ensuring consistent HTTP parsing rules across all layers of the infrastructure stack. Testing CDN, load balancer, proxy, and origin server interactions is crucial, as the most severe failures often arise from parser discrepancies between these components.
Ultimately, the core lesson is that a single injected CRLF sequence, when HTTP components fail to agree on request boundaries, can escalate into an infrastructure-wide risk for cache poisoning and XSS delivery. Organizations must prioritize robust security practices to prevent such incidents, which can be exacerbated by slow incident investigation processes.