This weakness occurs when an application accepts user-controlled data in HTTP headers and passes it to a downstream component such as a template engine…
This weakness occurs when an application accepts user-controlled data in HTTP headers and passes it to a downstream component (such as a template engine, JavaScript interpreter, or HTML renderer) without properly sanitizing it first. An attacker can inject scripting syntax into headers, which the downstream component then interprets as code rather than plain text, leading to unintended execution.
HTTP headers are often treated as "trusted" input because they come from the client's browser or network layer. However, headers can be manipulated by an attacker just like query parameters or form fields. When an application reads a header value (such as User-Agent, Referer, X-Custom-Header, or Accept-Language) and passes it directly into a context where scripting syntax is interpreted—such as embedding it in a template, logging it to a page, or passing it to a JavaScript engine—the attacker's injected code can execute. The vulnerability is especially dangerous when the header value is reflected back to the user in an HTTP response without encoding.
Successful exploitation can lead to cross-site scripting (XSS) attacks, where an attacker injects JavaScript that runs in a victim's browser. This can result in session hijacking, credential theft, malware distribution, or defacement. In some cases, if headers are processed server-side by a template engine or scripting language, the impact could extend to remote code execution or information disclosure.
from flask import Flask, request, render_template_string
app = Flask(__name__)
@app.route('/profile')
def profile():
user_agent = request.headers.get('User-Agent', 'Unknown')
# Directly embedding header value into template
html = f"<p>Your browser: {user_agent}</p>"
return render_template_string(html)Why it's vulnerable:
The User-Agent header is read directly and embedded into an HTML template string without encoding. An attacker can craft a request with a malicious User-Agent header containing script tags or event handlers, which will be rendered as executable code in the response.
from flask import Flask, request, render_template_string
from markupsafe import escape
app = Flask(__name__)
@app.route('/profile')
def profile():
user_agent = request.headers.get('User-Agent', 'Unknown')
# Properly escape the header value before embedding
safe_user_agent = escape(user_agent)
html = f"<p>Your browser: {safe_user_agent}</p>"
return render_template_string(html)<?php
$custom_header = $_SERVER['HTTP_X_CUSTOM_HEADER'] ?? 'default';
// Directly embedding header into output
echo "<div class='info'>Custom value: " . $custom_header . "</div>";
?>Why it's vulnerable:
The custom HTTP header is read from the $_SERVER superglobal and echoed directly into HTML without any encoding. An attacker can inject HTML or JavaScript through the header, which will execute in the browser.
<?php
$custom_header = $_SERVER['HTTP_X_CUSTOM_HEADER'] ?? 'default';
// Properly escape the header value for HTML context
echo "<div class='info'>Custom value: " . esc_html($custom_header) . "</div>";
?>eval(), template engines in unsafe mode, or other dynamic code execution contexts.
Content-Security-Policy to restrict script execution and reduce the impact of injected scripts.
Check your application logs for unusual or suspicious values in HTTP headers (especially custom headers or User-Agent). Look for patterns like <script>, javascript:, event handler attributes (onerror=, onload=), or HTML tags in header values. If you see these reflected in your application's output or error pages, the application may be vulnerable.
