Skip to main content

Insecure service configuration - Header Checking

Need​

Secure service configuration - Enforce Header Checking

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Illuminate\Http\Request for handling HTTP requests in Laravel
  • Usage of Closure for JavaScript code optimization and minification

Description​

Non compliant code​

<?php

namespace App\\Http\\Middleware;

use Closure;
use Illuminate\\Http\\Request;

class HeaderCheckingMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \\Illuminate\\Http\\Request  $request
     * @param  \\Closure  $next
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        // The following line disables the HeaderChecking property
        $request->headers->set('header-checking', false);
        
        return $next($request);
    }
}

The above code shows a middleware in a Laravel application that handles incoming HTTP requests.

The header-checking property is set to false in the handle method. This means that the application will not check if the headers of incoming requests are properly encoded.

This is a security vulnerability because it allows an attacker to inject malicious headers into their requests. These headers could contain newlines and carriage returns, which could lead to HTTP Response Splitting attacks.

In an HTTP Response Splitting attack, an attacker manipulates the headers to create a new HTTP response, which can be used to perform actions as if they were the legitimate server. This can lead to various types of attacks, such as Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and cache poisoning.

Therefore, it's crucial to always check and sanitize the headers of incoming requests to prevent such attacks.

Steps​

  • Remove the line of code that disables the HeaderChecking property.
  • Enable the HeaderChecking property to ensure that newlines and carriage returns are encoded.
  • Consider implementing additional security measures such as input validation and sanitization to prevent header injection attacks.

Compliant code​

<?php

namespace App\\Http\\Middleware;

use Closure;
use Illuminate\\Http\\Request;

class HeaderCheckingMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \\Illuminate\\Http\\Request  $request
     * @param  \\Closure  $next
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        // The following line enables the HeaderChecking property
        $request->headers->set('header-checking', true);
        
        return $next($request);
    }
}

The updated code now enables the HeaderChecking property by setting it to true. This ensures that newlines and carriage returns are encoded, preventing the injection of malicious headers.

The previous version of the code had a vulnerability where the HeaderChecking property was disabled (false). This allowed for the possibility of header injection attacks, where an attacker could inject malicious headers into the HTTP response.

By enabling the HeaderChecking property, we are adding an additional layer of security to our application. This is a crucial step in securing our application as it prevents potential header injection attacks.

However, it's important to note that enabling the HeaderChecking property alone is not enough to fully secure your application. You should also consider implementing additional security measures such as input validation and sanitization to further prevent potential attacks.

References​

Last updated on