June 2019 Summaries

HTTP Response Splitting is a security vulnerability where attackers manipulate response headers to insert arbitrary headers, potentially leading to Cross-Site Scripting (XSS) attacks. This occurs when the `Location` header value is not properly sanitized, allowing hackers to inject a second HTTP response with defined headers and HTML content. If the `Location` header is empty or under complete attacker control, the browser may ignore redirection, enabling XSS. Other headers, like `Link` and `Set-Cookie`, may also be vulnerable, with the latter potentially leading to session fixation if new cookies are set for the user. Proper mitigation involves sanitizing `Location` header values, filtering out carriage return and line feed characters, and ensuring users cannot control the entire `Location` header value. The Detectify Security Research team offers an online vulnerability scanner to identify such vulnerabilities, promoting enhanced web application security.