Common Weakness Enumeration

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Abstraction

Variant

Related CVEs

▪ References & documentation

https://cwe.mitre.org/data/definitions/113.html NVD CWE listing

▪ How attackers exploit CWE-113

MITRE ATT&CK techniques associated with this weakness class (mapped via MITRE CAPEC). A vulnerability of this type could let an adversary carry out:

T1082System Information Discoverydiscovery T1539Steal Web Session Cookiecredential-access

Step-by-step: how CWE-113 gets exploited

A stage-by-stage walkthrough of the attack, mapped to the real MITRE ATT&CK tactics for this weakness — what the attacker is trying to do, what's at risk (what can be stolen or damaged), and how you defend. Understanding the playbook is how you shut it down.

1
Credential accesscredential-access
Steal passwords, tokens, keys, and session material.
At risk / what's stolen
Passwords, API keys, session tokens, SSH/TLS keys, and secrets in memory, env, or config.
How you defend
Secret managers, short-lived tokens, and no secrets in code/env/logs.
2
Discoverydiscovery
Map what else is reachable — hosts, services, data stores, and accounts.
At risk / what's stolen
Internal topology, service inventory, and data locations the attacker enumerates.
How you defend
Network segmentation and detection of unusual internal scanning.

This is a defensive, conceptual walkthrough for education — stages reflect MITRE ATT&CK tactics associated with this weakness class, not a working exploit. Not every attack uses every stage.