Crlf Injection in Flask

Crlf injection in Flask applications typically occurs when user-controlled data flows into HTTP headers, response headers, or cookie values without proper validation. Flask's request/response cycle makes certain patterns particularly vulnerable to this attack.

The most common Flask-specific vulnerability appears in flask.Response objects where developers might construct headers dynamically. Consider this Flask route:

from flask import Flask, request, make_response
app = Flask(__name__)

@app.route('/set-header')
def set_header():
    user_header = request.args.get('header')
    user_value = request.args.get('value')
    
    response = make_response('Header set')
    response.headers[user_header] = user_value
    return response

An attacker could craft a request like:

/set-header?header=Content-Type&value=text/html%0d%0a%0d%0a<script>alert(1)</script>

The %0d%0a sequences (CRLF) would break out of the header section and inject HTML content, potentially leading to XSS if the response is rendered in a browser.

Flask's send_file function presents another attack vector. When serving files with dynamic content types:

@app.route('/download')
def download():
    filename = request.args.get('file')
    content_type = request.args.get('type', 'application/octet-stream')
    
    return send_file(filename, mimetype=content_type)

If content_type contains CRLF sequences, an attacker could manipulate the response structure. This becomes especially dangerous when combined with Flask's default behavior of setting various security headers.

Cookie manipulation in Flask also enables CRLF injection. The set_cookie method doesn't automatically sanitize values:

@app.route('/set-cookie')
def set_cookie():
    name = request.args.get('name')
    value = request.args.get('value')
    
    response = make_response('Cookie set')
    response.set_cookie(name, value)
    return response

An attacker could set a cookie with embedded CRLF to manipulate subsequent responses or perform session fixation attacks.

Detecting CRLF injection in Flask requires examining both the application code and runtime behavior. Start by auditing your Flask routes for patterns where user input directly influences headers, cookies, or response content.

Static code analysis should flag these Flask-specific patterns:

import re

def detect_crlf_vulnerabilities(app):
    vulnerabilities = []
    
    for rule in app.url_map.iter_rules():
        view_func = app.view_functions[rule.endpoint]
        
        # Check for direct header manipulation
        if 'headers' in view_func.__code__.co_names:
            vulnerabilities.append(f'Potential header injection in {rule.rule}')
        
        # Check for send_file usage with dynamic parameters
        if 'send_file' in view_func.__code__.co_names:
            vulnerabilities.append(f'Dynamic file serving in {rule.rule}')
        
        # Check for cookie manipulation
        if 'set_cookie' in view_func.__code__.co_names:
            vulnerabilities.append(f'Cookie manipulation in {rule.rule}')
    
    return vulnerabilities

Runtime detection with middleBrick provides automated scanning that specifically tests Flask applications for CRLF injection. The scanner sends requests with encoded CRLF sequences (%0d%0a) in various parameters and analyzes responses for header manipulation or content injection.

middleBrick's Flask-specific detection includes:

• Testing header injection points by sending malicious header names and values
• Scanning send_file endpoints with crafted content-type parameters
• Examining cookie-setting endpoints for CRLF vulnerabilities
• Checking for improper header sanitization in Flask's built-in error handlers

The scanner provides a security risk score (A–F) and identifies specific endpoints vulnerable to CRLF injection, along with severity levels and remediation guidance.

Remediating CRLF injection in Flask requires both input validation and secure coding practices. Flask provides several mechanisms to prevent these attacks.

The most effective approach is input sanitization using Flask's built-in utilities:

from flask import Flask, request, make_response, escape
import re
app = Flask(__name__)

# Regular expression to detect CRLF sequences
CRLF_PATTERN = re.compile(r'[
]+')

def sanitize_header_input(value):
    if CRLF_PATTERN.search(value):
        raise ValueError('Header contains invalid characters')
    return value

def sanitize_cookie_input(value):
    if CRLF_PATTERN.search(value):
        raise ValueError('Cookie value contains invalid characters')
    return value

Apply these sanitizers to all user-controlled inputs:

@app.route('/set-header')
def set_header():
    user_header = request.args.get('header')
    user_value = request.args.get('value')
    
    # Sanitize inputs
    try:
        safe_header = sanitize_header_input(user_header)
        safe_value = sanitize_header_input(user_value)
    except ValueError as e:
        return f'Invalid input: {e}', 400
    
    response = make_response('Header set')
    response.headers[safe_header] = safe_value
    return response

For file serving endpoints, validate content types against a whitelist:

ALLOWED_CONTENT_TYPES = {
    'application/pdf': 'pdf',
    'image/jpeg': 'jpg',
    'image/png': 'png',
    'text/plain': 'txt'
}

@app.route('/download')
def download():
    filename = request.args.get('file')
    content_type = request.args.get('type', 'application/octet-stream')
    
    # Validate content type
    if content_type not in ALLOWED_CONTENT_TYPES:
        return 'Invalid content type', 400
    
    return send_file(filename, mimetype=content_type)

Flask's after_request decorator can enforce additional security by inspecting and sanitizing response headers:

@app.after_request
def secure_headers(response):
    # Remove any suspicious headers that might have been injected
    for header in response.headers:
        if CRLF_PATTERN.search(header):
            response.headers.pop(header, None)
    
    return response

For comprehensive protection, integrate middleBrick's CLI tool into your development workflow:

# Scan your Flask app before deployment
middlebrick scan http://localhost:5000 --output report.json

# Integrate into CI/CD
npm install -g middlebrick
middlebrick scan https://api.yourdomain.com --fail-below B

This ensures CRLF injection vulnerabilities are caught early, with middleBrick providing specific findings mapped to OWASP API Top 10 categories and actionable remediation steps.