|Requires Admin Access:||Yes|
|Credit:||it.sec GmbH & Co. KG – Hans-Martin Münch & Markus Piéton|
A header injection allows a attacker to insert arbitrary HTTP-Headers into the server’s response. This enables a attacker to change cookie values, add additional headers or in the case of a normal page to insert arbitrary code that gets executed as soon as the client receives the server’s response.
As a workaround, we suggest using a Application firewall to block access to those urls externally.