Crlf Injection in Feathersjs with Hmac Signatures

Crlf Injection occurs when an attacker can inject carriage return (CR, \r) and line feed (\n) characters into a header or key-value segment of an HTTP message. In Feathersjs applications that use Hmac Signatures for request authentication, this becomes particularly dangerous because the injected newline can allow an attacker to create a second, malicious signature line without invalidating the first valid line. Many Hmac verification schemes concatenate headers (such as timestamp and nonce) with a secret to compute an Hmac. If a developer splits that string on newline characters and processes only the first line, an attacker-supplied newline can terminate the expected data and append a new line that the server may still accept.

Consider a Feathersjs service that expects an Authorization header formatted as HMAC timestamp=1700000000,nonce=abc123 and computes the Hmac over the string timestamp=1700000000\nnonce=abc123. If the attacker can inject a newline, they might send timestamp=1700000000\nonce=abc123\nextradata=value. Some implementations that split on newline and take the first segment will compute the correct Hmac for timestamp=1700000000\nonce=abc123 and then ignore the extra line, effectively accepting a request that includes attacker-controlled parameters (extradata). This can lead to BOLA/IDOR-like outcomes when the extra data influences resource selection or bypasses intended constraints.

Input validation that does not reject \r or \n in header values compounds the risk. For example, if a timestamp header is used without sanitization, an attacker can inject newlines to manipulate parsing logic. Even if the Hmac is computed over the full header string, a newline in an unexpected place can change how parsers split key-value pairs, enabling header smuggling or parameter injection. Rate limiting and data exposure checks may also be bypassed if injected lines alter how request metadata is interpreted by the application or by an API gateway that relies on newline-sensitive parsing.

To detect this pattern, middleBrick scans for the presence of \r or \n in header values and examines how the server parses multi-line inputs. The LLM/AI Security checks specifically look for prompt injection techniques that rely on newline manipulation, which parallels how newline injection can subvert parsing logic in APIs. Observability into whether the server distinguishes lines versus treating input as a single blob helps identify whether Crlf Injection is feasible in the Hmac flow.

Remediation centers on strict input validation, canonical construction of the signed string, and robust parsing that does not rely on simple newline splits. Ensure that header values do not contain \r or \n, and enforce a single, deterministic format for the data that is signed.

First, sanitize and normalize inputs before building the string to sign. For timestamp and nonce, reject any values containing carriage returns or line feeds:

function sanitize(value) {
  if (typeof value !== 'string') throw new Error('Invalid type');
  if (/[\r\n]/.test(value)) {
    throw new Error('Invalid characters in input');
  }
  return value;
}

const timestamp = sanitize(req.headers['x-timestamp']);
const nonce = sanitize(req.headers['x-nonce']);

Second, construct the string to sign in a canonical way that does not depend on split behavior. Use a clearly defined delimiter that is not allowed in inputs, and avoid newlines:

const stringToSign = `timestamp=${timestamp},nonce=${nonce}`;
const expectedSignature = crypto.createHmac('sha256', secret).update(stringToSign).digest('hex');

Third, verify the signature in a single, constant-time comparison to avoid leaking information via timing differences. Do not re-parse the raw header with line-based splits; instead, extract parameters from the already-sanitized values:

const providedSignature = req.headers['authorization']?.replace('HMAC ', '');
if (!crypto.timingSafeEqual(Buffer.from(expectedSignature), Buffer.from(providedSignature))) {
  throw new Error('Invalid signature');
}

Finally, enforce strict schema validation for incoming headers and body parameters. MiddleBrick’s Property Authorization and Input Validation checks can highlight cases where newline characters are accepted. When using the CLI to scan from terminal with middlebrick scan <url>, you can quickly identify endpoints that accept unsafe header values. For teams needing continuous oversight, the Pro plan’s continuous monitoring and GitHub Action integration can fail builds if risk scores exceed your defined thresholds, helping prevent regressions that could reintroduce newline-sensitive parsing issues.

These steps ensure that Hmac verification in Feathersjs remains resilient against Crlf Injection, while keeping the signed string deterministic and the verification logic simple and robust.