Security risk of CRLF injection
My client is concerned about security measures when in using pega as an internet service.
There is CRLF injection as one security attack, but does Pega take some measures against this security attack?
About CRLF Injection:
https://www.owasp.org/index.php/CRLF_Injection
https://www.netsparker.com/blog/web-security/crlf-http-header/
***Edited by Moderator Marissa to update platform capability***
Accepted Solution
HCL Technologies
NL
All the modern application servers are inherently have protection for response splitting attacks. If we insert a header with value that contains CRLF characters the servers automatically replace them with a space character.
Pegasystems Inc.
US
Hi @tamont52,
After discussing your thread with our Support Engineers, they have asked that you submit a Support Request so that they may discuss this with you offline.
Please reference this PSC post in your Support Request and that you were advised to open a SR by our Engineers. Then please come back and comment here with your Support Request ID so that we may track for you.
Thank you!
Accepted Solution
HCL Technologies
NL
All the modern application servers are inherently have protection for response splitting attacks. If we insert a header with value that contains CRLF characters the servers automatically replace them with a space character.