0

In ASP.NET, there is a setting EnableHeaderChecking that ensures no CRLF (newlines) are output in response headers. This prevents possible "response splitting" attacks.

Is there any equivalent configuration for classic ASP pages - specifically in IIS 5.1?

I have a large web application in classic ASP, where it appears some Response.Redirect calls are not filtering user input. So they are vulnerable to response splitting attacks.

The solution is to update all these pages so they filtering user input. Is there any setting at the server level to prevent (or encode) newlines in response headers?

1 Answer 1

1

IIS 5.1 doesn't have an easy way to change the response headers. If you're up for writing an ISAPI extension you can do it, but you would likely have an easier time upgrading to Win7/2008 (IIS7) and using HTTP Modules instead.

If upgrading to IIS7 isn't an option, it's probably easiest to write a helper method in code like CleanResponseRedirect(url) that can do the cleaning for you before the Response.Redirect. Then replace all of your response.redirects with CleanResponseRedirect().

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .