What is Improper Neutralization of CRLF Sequences (CWE-93)?

TL;DR: Improper Neutralization of CRLF Sequences (‘CRLF Injection’) (CWE-93) is a web application security vulnerability that occurs when an application fails to properly neutralize or incorrectly neutralizes carriage return line feed (CRLF) sequences from inputs, allowing attackers to inject malicious code. To fix this vulnerability, you should avoid using CRLF as a special sequence, filter or quote CRLF sequences in user-controlled input, and use secure coding practices.

At-a-Glance Table

What is Improper Neutralization of CRLF Sequences (‘CRLF Injection’)?

Improper Neutralization of CRLF Sequences (‘CRLF Injection’) (CWE-93) is a type of web application security vulnerability that occurs when an application fails to properly neutralize or incorrectly neutralizes carriage return line feed (CRLF) sequences from inputs, allowing attackers to inject malicious code. As defined by the MITRE Corporation under CWE-93, and classified by the OWASP Foundation under A05:2025 - Injection, this vulnerability can lead to security breaches and modification of application data.

Quick Summary

Improper Neutralization of CRLF Sequences (‘CRLF Injection’) is a critical web application security vulnerability that occurs when an application fails to properly neutralize or incorrectly neutralizes carriage return line feed (CRLF) sequences from inputs. This vulnerability can lead to security breaches and modification of application data, making it essential to detect and fix this issue.

Jump to: What is Improper Neutralization of CRLF Sequences (‘CRLF Injection’)? · Quick Summary · Improper Neutralization of CRLF Sequences (‘CRLF Injection’) Overview · How Improper Neutralization of CRLF Sequences (‘CRLF Injection’) Works · Business Impact of Improper Neutralization of CRLF Sequences (‘CRLF Injection’) · Improper Neutralization of CRLF Sequences (‘CRLF Injection’) Attack Scenario · How to Detect Improper Neutralization of CRLF Sequences (‘CRLF Injection’) · How to Fix Improper Neutralization of CRLF Sequences (‘CRLF Injection’) · Framework-Specific Fixes for Improper Neutralization of CRLF Sequences (‘CRLF Injection’) · How to Ask AI to Check Your Code for Improper Neutralization of CRLF Sequences (‘CRLF Injection’) · Improper Neutralization of CRLF Sequences (‘CRLF Injection’) Best Practices Checklist · Improper Neutralization of CRLF Sequences (‘CRLF Injection’) FAQ · Vulnerabilities Related to Improper Neutralization of CRLF Sequences (‘CRLF Injection’) · References · Scan Your Own Site

Improper Neutralization of CRLF Sequences (‘CRLF Injection’) Overview

What: Improper Neutralization of CRLF Sequences (‘CRLF Injection’) is a type of web application security vulnerability that occurs when an application fails to properly neutralize or incorrectly neutralizes carriage return line feed (CRLF) sequences from inputs.

Why it matters: Improper Neutralization of CRLF Sequences (‘CRLF Injection’) can lead to security breaches and modification of application data, making it essential to detect and fix this issue.

Where it occurs: This vulnerability typically occurs in web applications that use HTTP requests and CRLF sequences.

Who is affected: Web developers and users who interact with vulnerable web applications are affected by this vulnerability.

Who is NOT affected: Applications that never construct paths/queries/commands from external input, or systems already using secure coding practices to prevent this issue, are not affected.

How Improper Neutralization of CRLF Sequences (‘CRLF Injection’) Works

Root Cause

The root cause of Improper Neutralization of CRLF Sequences (‘CRLF Injection’) is the failure of an application to properly neutralize or incorrectly neutralizes carriage return line feed (CRLF) sequences from inputs.

Attack Flow

1. An attacker sends a request with malicious CRLF sequences.
2. The application fails to properly neutralize or incorrectly neutralizes the CRLF sequences, allowing the attacker to inject malicious code.
3. The injected malicious code is executed by the application, leading to security breaches and modification of application data.

Prerequisites to Exploit

• The application must use HTTP requests and CRLF sequences.
• The attacker must be able to send a request with malicious CRLF sequences.
• The application must fail to properly neutralize or incorrectly neutralize the CRLF sequences.

Vulnerable Code

import os

path = request.form['path']
os.chdir(path)

This code is vulnerable because it uses an external input source (request.form['path']) and fails to properly neutralize or incorrectly neutralizes the CRLF sequences, allowing an attacker to inject malicious code.

Secure Code

import os

path = request.form['path']
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')
os.chdir(path)

This code is secure because it properly neutralizes or correctly neutralizes the CRLF sequences by checking if the input path starts with a valid base directory.

Business Impact of Improper Neutralization of CRLF Sequences (‘CRLF Injection’)

Confidentiality: The modification of application data can lead to unauthorized access to sensitive information, compromising confidentiality.

Integrity: The modification of application data can lead to unauthorized changes to the application’s functionality, compromising integrity.

Availability: The security breaches caused by Improper Neutralization of CRLF Sequences (‘CRLF Injection’) can lead to downtime and loss of availability.

Improper Neutralization of CRLF Sequences (‘CRLF Injection’) Attack Scenario

1. An attacker sends a request with malicious CRLF sequences.
2. The application fails to properly neutralize or incorrectly neutralizes the CRLF sequences, allowing the attacker to inject malicious code.
3. The injected malicious code is executed by the application, leading to security breaches and modification of application data.

How to Detect Improper Neutralization of CRLF Sequences (‘CRLF Injection’)

Manual Testing

• Review the application’s code for vulnerable patterns.
• Test the application with malicious CRLF sequences.
• Verify that the application properly neutralizes or correctly neutralizes the CRLF sequences.

Automated Scanners (SAST / DAST)

Automated scanners can detect Improper Neutralization of CRLF Sequences (‘CRLF Injection’) by analyzing the application’s code and testing it for vulnerable patterns. However, dynamic/runtime testing is required to catch this issue, as static analysis may not be sufficient.

PenScan Detection

PenScan’s automated scanner engines actively test for this issue.

False Positive Guidance

A finding on a header value set through the framework’s HTTP response API (which typically rejects or strips embedded CR/LF characters automatically) rather than raw string concatenation into the response is a false positive — confirm the framework’s header-setting call doesn’t already neutralize CRLF before treating the finding as real.

How to Fix Improper Neutralization of CRLF Sequences (‘CRLF Injection’)

• Avoid using CRLF as a special sequence.
• Filter or quote CRLF sequences in user-controlled input.
• Use secure coding practices to prevent this issue.

Framework-Specific Fixes for Improper Neutralization of CRLF Sequences (‘CRLF Injection’)

Java

import java.io.File;

String path = request.getParameter('path');
if (!new File(path).isAbsolute()) {
    throw new RuntimeException("Invalid path");
}

This code is secure because it properly neutralizes or correctly neutralizes the CRLF sequences by checking if the input path starts with a valid absolute file.

Node.js

const fs = require('fs');

let path = request.body.path;
if (!fs.existsSync(path)) {
    throw new Error("Invalid path");
}

This code is secure because it properly neutralizes or correctly neutralizes the CRLF sequences by checking if the input path exists as a file.

Python/Django

import os

path = request.GET.get('path')
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError('Invalid path')

This code is secure because it properly neutralizes or correctly neutralizes the CRLF sequences by checking if the input path starts with a valid base directory.

PHP

$path = $_GET['path'];
if (!is_absolute_path($path)) {
    throw new Exception("Invalid path");
}

This code is secure because it properly neutralizes or correctly neutralizes the CRLF sequences by checking if the input path starts with a valid absolute file.

How to Ask AI to Check Your Code for Improper Neutralization of CRLF Sequences (‘CRLF Injection’)

You can ask AI to check your code for Improper Neutralization of CRLF Sequences (‘CRLF Injection’) by providing the relevant code block and asking it to review it for vulnerable patterns. Here is a copy-pasteable prompt you can use:

Improper Neutralization of CRLF Sequences (‘CRLF Injection’) Best Practices Checklist

✅ Review the application’s code for vulnerable patterns. ✅ Test the application with malicious CRLF sequences. ✅ Verify that the application properly neutralizes or correctly neutralizes the CRLF sequences. ✅ Avoid using CRLF as a special sequence. ✅ Filter or quote CRLF sequences in user-controlled input.

Improper Neutralization of CRLF Sequences (‘CRLF Injection’) FAQ

How does Improper Neutralization of CRLF Sequences (‘CRLF Injection’) occur?

Improper Neutralization of CRLF Sequences (‘CRLF Injection’) occurs when an application fails to properly neutralize or incorrectly neutralizes carriage return line feed (CRLF) sequences from inputs, allowing attackers to inject malicious code.

What are the consequences of Improper Neutralization of CRLF Sequences (‘CRLF Injection’)?

The consequences of Improper Neutralization of CRLF Sequences (‘CRLF Injection’) include modification of application data and potential security breaches.

How can I detect Improper Neutralization of CRLF Sequences (‘CRLF Injection’) in my code?

You can detect Improper Neutralization of CRLF Sequences (‘CRLF Injection’) by using automated scanner engines, manual testing, or reviewing your code for vulnerable patterns.

What are the best practices to prevent Improper Neutralization of CRLF Sequences (‘CRLF Injection’)?

The best practices to prevent Improper Neutralization of CRLF Sequences (‘CRLF Injection’) include avoiding the use of CRLF as a special sequence, filtering or quoting CRLF sequences in user-controlled input, and using secure coding practices.

Can AI help me detect and fix Improper Neutralization of CRLF Sequences (‘CRLF Injection’)?

Yes, AI can help you detect and fix Improper Neutralization of CRLF Sequences (‘CRLF Injection’) by reviewing your code for vulnerable patterns and providing recommendations for secure coding practices.

What are the related vulnerabilities to Improper Neutralization of CRLF Sequences (‘CRLF Injection’)?

The related vulnerabilities to Improper Neutralization of CRLF Sequences (‘CRLF Injection’) include CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-117 (Improper Output Neutralization for Logs).

What are the framework-specific fixes for Improper Neutralization of CRLF Sequences (‘CRLF Injection’)?

The framework-specific fixes for Improper Neutralization of CRLF Sequences (‘CRLF Injection’) include using secure coding practices, filtering or quoting CRLF sequences in user-controlled input, and avoiding the use of CRLF as a special sequence.

How can I ask AI to check my code for Improper Neutralization of CRLF Sequences (‘CRLF Injection’)?

You can ask AI to check your code for Improper Neutralization of CRLF Sequences (‘CRLF Injection’) by providing the relevant code block and asking it to review it for vulnerable patterns.

Vulnerabilities Related to Improper Neutralization of CRLF Sequences (‘CRLF Injection’)

References

• MITRE CWE-93
• OWASP A05:2025 - Injection
• CAPEC-15, CAPEC-81
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Neutralization of CRLF Sequences (‘CRLF Injection’) and other risks before an attacker does.