SA-2007-024 (17 October 2007) HTTP response splitting

  • Advisory ID: DRUPAL-SA-2007-024
  • Project: Drupal core
  • Version: 4.6.x, 4.7.x, 5.x
  • Date: 2007-October-17
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: HTTP response splitting

In some circumstances Drupal allows user-supplied data to become part of response headers. As this user-supplied data is not always properly escaped, this can be exploited by malicious users to execute HTTP response splitting attacks which may lead to a variety of issues, among them cache poisoning, cross-user defacement and injection of arbitrary code.

The official announcement for Drupal 4.7.x and 5.x is here, and the official patch for Drupal 4.7.x is here.

Considerations for Drupal 4.6

The same exploit is possible via the function drupal_goto(), and therefore Drupal 4.6 must be patched against this vulnerability, using the same approach as the official 4.7 patch.