CRLF-Powered Desync Lets Attackers Poison CDN Cache and Serve XSS to Live Users

A limited CRLF injection flaw can be escalated into a severe HTTP desynchronization attack, poisoning CDN caches and delivering XSS payloads to users on legitimate websites.The attack, called CRLF-Powered Desync, begins when an application incorrectly handles encoded carriage return and line feed characters, commonly represented as %0d%0a. These characters mark new lines in HTTP messages. If a front-end server decodes them before forwarding a request to a backend server, an attacker may inject new HTTP headers or alter the structure of the upstream request. One risky configuration involves Nginx deployments that place variables such as $uri in proxy_pass directives. Nginx can normalize and URL-decode the path...

Read the full article at the source.