# HTTP Response Splitting (CRLF injection) due to headers overflow

Overlong reflected parameter in Twitter safety report endpoint overflows response headers, causing a regenerated response to include an injected Set-Cookie header.

- Payout: hidden
- Severity: medium
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2015-05-04
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/53843
- Library page: https://bugbountylibrary.com/r/h1%3A53843
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:cache-poisoning vuln:crlf-injection

**Target:** twitter.com /i/safety/report_story endpoint
**Root cause:** When reflected response header fields exceed ~7000 bytes, the original response is discarded and a new response is generated that includes attacker-injected header content from the oversized parameter.
**Steps:**
1. Request `https://twitter.com/i/safety/report_story?next_view=report_story_start&source=reporttweet&reported_user_id=1&reporter_user_id=1&is_media=true&is_promoted=true&reported_tweet_id=` followed by a long run of `+` (spaces) exceeding ~7000 bytes, ending with `set-cookie:a`
2. Refresh if HTTP 500 occurs
3. Observe the regenerated response contains the injected `set-cookie:a` header
**How found:** Researcher noted similarity to prior report #52042 but identified a different root cause: header field overflow (~>7000 bytes) triggers response regeneration that reflects injected content. Reasoned that any endpoint reflecting parameters into headers is vulnerable.
**Exploitation:** Attacker crafts a URL with an oversized reflected parameter that overflows response header fields; the server discards the response and serves a new one containing the injected header, allowing arbitrary header injection (e.g. Set-Cookie) in the victim's response.
**Insight:** When a parameter is reflected into a response header, try padding it past internal header-size limits (~7-8KB); frameworks that discard oversized responses and regenerate them may re-emit the attacker-controlled header content, yielding CRLF injection without literal newline characters.