How to prevent CRLF injection (Http response splitting) in php

Question

I did R&D on prevention of CRLF injection in php, but i didn't find any solution in mycase, as I'm using a burp suite tool to inject some headers using CRLF characters like the below.

// Using my tool i put CRLF characters at the start of my request url 
GET /%0d%0a%20HackedHeader:By_Hacker controller/action

//This generates an header for me like below
HackedHeader:By_Hacker

So i can modify all headers by doing just like above

This tool is just like a proxy server so it catches the request and gives the response and we can modify the response in the way we want.

So i'm just modifying the response by injecting some headers using CRLF characters. Now the Server responds to this request by injecting the CRLF characters in the response.

I'm just worried as header fields like Pragma, Cache-Control, Last-Modified can lead to cache poisoning attacks.

header and setcookie contain mitigations against response/header splitting, But these can't support me in fixing the above issue

Edit

When i request to mysite.com contact us page like below This is the request I captured in my tool like below

Request headers:
GET /contactus HTTP/1.1
Host: mysite.com
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

And i get the Response HTML for the above request

Now for the same request using the tool i'm adding custom headers just like below

Request Headers:
GET /%0d%0a%20Hacked_header:By_Hacker/contactus HTTP/1.1
Host: mysite.com
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

Response Headers:
HTTP/1.1 302 Found
Date: Fri, 10 Jul 2015 11:51:22 GMT
Server: Apache/2.2.22 (Ubuntu)
Last-Modified: Fri, 10 Jul 2015 11:51:22 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: mysite.com
 Hacked_header:By_Hacker/..
Vary: Accept-Encoding
Content-Length: 2
Keep-Alive: timeout=5, max=120
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

You can see the injected header Hacked_header:By_Hacker/.. in the above response

Is there anyway in php or apache server configuration to prevent such kind of headers' hack?

Answer 1

Not sure why all the down votes - infact, it is an interesting question :)

I can see that you have tagged CakePHP - which means your app is using Cake Framework... Excellent! If you are using Cake 3 , it is automatically strip off : %0d%0a

Alternatively, where you receive the response header, just strip off %0d%0a and you are good!

Where things like these could be applied - a 3rd party API response or say.... a Webhook response! or a badly sanitized way to handle intl.. example : lang=en to lang=fr where the GET param is directly set as response header... That would not be a wise move!

Ideally, the responses will be as GET and not in the header but either way just strip the %0d%0a and you are good.

Answering your edit.

You can see the injected header Hacked_header:By_Hacker/.. in the above response

That injected header cannot be controlled or stopped, mate. We do not have control over what the other server does.

The question is.. What do you do with the response header?

The answer is... You sanitize it, as ndm said you need to sanitize the input.. What you get as a response IS an input. As soon as you detect %0d%0a, discard the response.

Need code work?

<?php
$cr = '/\%0d/';
$lf = '/\%0a/';

$response = // whatever your response is generated in;
$cr_check = preg_match($cr , $response);
$lf_check = preg_match($lf , $response);

if (($cr_check > 0) || ($lf_check > 0)){
    throw new \Exception('CRLF detected');
}