Making HTTP header injection critical with one prompt
Summary
PortSwigger Research describes how HTTP header injection can be escalated into a CRLF-powered desync, allowing an attacker to redirect random users to a collaborator server with a single prompt. The article announces a new scan check that detects this escalation.
IFF Assessment
The research and new scan check give defenders and testers a way to detect a serious escalation path before attackers exploit it at scale.
Defender Context
Header injection flaws that enable CRLF desync can lead to response splitting, cache poisoning, and mass user redirection, so severity depends heavily on the surrounding architecture. Defenders should review proxies, load balancers, and applications for unsanitized header values and validate header input strictly. Automated scanning that chains a low-severity injection into a desync is a growing trend, and such checks can surface issues that manual testing misses.