Vinoth (Community Member) asked a question.
How to fix CRLF - HTTP Response splitting in Java?
Actual Message in Veracode Scan :
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')(CWE ID 113)
I have tried lot of ways to fix the CRLF(Own Fix), but it does not passing in Veracode scan.So I implemented ESAPI Jar fix the issue. But it internally does have lot of vulnerabilities.
Is there is any other way to fix the CRLF flaws other than ESAPI Jar and the fix should pass the veracode scan?
Please advise on this issue.
.png){kind=logo}
There is a list of Supported Cleansing Functions the scanner will recognize as a way to address CRLF injection: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/QSde6PQlbxAPLvVx1K933A . I would recommend you use a cleanser from this list if you can.
Also, I believe vulnerabilities in the ESAPI jar that were reported in earlier version are specific to certain libraries/tools and does not affect the encoding/cleansing methods. The latest version 2.1.0.1 does not have any reported vulnerabilities.
Yes, you are correct issue is not with the ESAPI Jar, its about the dependent jar used by the ESAPI (mentioned below)
1. antisamy-1.5.3.jar
2. commons-httpclient-3.1.jar
3. xercesImpl-2.8.0.jar
4. batik-util-1.8.jar
5. batik-ext-1.8.jar
6. xalan-2.7.0.jar
7. batik-css-1.8.jar
8. commons-beanutils-core-1.8.3.jar
These all jar containing the High and Medium flaws inside.
As you advised, I have gone through the link that you provided in the above comment.
I have used this encoder - org.owasp.encoder.Encode.forHtml to fix the flaw. It passed the veracode, but it does not removing the CRLF characters.
It looks like this encoder jar is for entirely an encoding thing.
Could you please advise on this?
Please follow the blog to fix this issue : https://webspidertech.wordpress.com/2018/07/31/veracode-flaws-crlf-http-response-splitting-cwe-113-java/