C-sharp : HTTP header manipulation

The application allows to include newline characters into the HTTP response header. If data from an untrusted source is included into the HTTP response header, multiple attacks are possible, including cache poisoning, XSS, cookie manipulation, page hijacking, open redirect attacks and others.

One of the most common attacks with the use of this vulnerability is HTTP response splitting. In this case, the attacker includes special CR (carriage return, also denoted as %0d and \r) and LF (new line, also %0a and \n) characters into the response header. This allows the attacker to not only manage the content of a response after these characters, but also create his/her own responses.

By default .NET disallows the inclusion of newline characters into the HTTP response header. This behavior can be overriden be setting the EnableHeaderChecking property on the HttpRuntimeSection object to false.