joyent/node — pull request #4290 by charliesome (2012-11-19 01:50:23+00:00)
Title: Protect against HTTP response splitting

The HTTP module is currently vulnerable to response splitting attacks.

Here's an example:

var http = require("http"),
url = require("url");

http.createServer(function (req, res) {
var queryData = url.parse(req.url, true).query;
res.writeHead(302, { "Location": queryData.redirect });
res.end();
}).listen(1337, "127.0.0.1");

An attacker can split the response by passing `%0d%0a` in the query string in order to inject their own headers/body.

Here's a PoC link: http://127.0.0.1:1337/?redirect=%0d%0aContent-Length:%2033%0d%0a%0d%0a%3Ch1%3E%3Cmarquee%3Eowned%3C/marquee%3E%3C/h1%3E