php-crlf-audit

PHP CRLF Response Splitting Audit (php-crlf-audit)

Analyze PHP project source code to identify whether user-controllable data enters response headers (header), Cookies, or other data that can be interpreted by browsers/middleware as new headers, thereby causing response splitting, cache poisoning, or redirection hijacking.

Severity Ratings and Numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-CRLF-{序号}

Mandatory Sinks (Required)

Identify the following points:

• header() the header value parameter contains user input
• setcookie() the cookie name/value/domain/path contains user input
• Functions/wrappers that output to custom headers (which ultimately still call header)
• Concatenation into HTTP response headers within the returned body (rare, but still must be evidenced in code)

Mandatory Filtering and Normalization Checks (Required)

Must output:

• Whether \r、\n has rejection or sanitization applied
• Whether visible control characters have been handled
• Whether URL encoding/escaping has been performed (but note: incorrect "partial filtering" may be bypassable)

PoC (Required)

• Must provide the real route and controllable field name
• The payload must demonstrate CRLF:%0d%0a(or \r\n) and explain the expected effect (such as injecting Location or a custom header)

Report Output

{output_path}/vuln_audit/crlf_{timestamp}.md

Entry Template (Required)

Must include: location evidence + data flow chain + exploitable preconditions + PoC + remediation recommendations + code search statements.

Evidence Citation (Required: from php-route-tracer)

Each suspected CRLF/response splitting vulnerability must cite, item by item, from the trace output ## 9) Sink Evidence Type Checklist the CRLF linecorresponding evidence points (the status may be pending verification, but evidence citations must exist):

1. EVID_CRLF_OUTPUT_POINT: Location evidence for the response header/Cookie output point (final output locations such as header/setcookie)
2. EVID_CRLF_USER_INPUT_INTO_HEADER_COOKIE: Evidence of user input entering the header/cookie value (including the control character entry point)
3. EVID_CRLF_CONTROL_CHAR_FILTERING_ENCODING：\r\n or control character filtering/encoding evidence (the corresponding snippet of the rejection/sanitization/encoding implementation)

Handling of Missing tracer Evidence (Required)

• If any of the key evidence points 1~3 above cannot be located: the vulnerability status can only be marked as ⚠️待验证must not be given ✅已确认可利用。