CWE-144 applies when the product receives input from an upstream component but does not neutralize, or incorrectly neutralizes, special elements that could be read as line delimiters by a downstream component. It is a variant of CWE-140, and it is not specific to any language.
How it happens
Plenty of formats treat the end of a line as meaningful: config files, log files, mail headers, protocol commands. If input containing a line break is placed in one of them, the attacker gets a fresh line of their own.
MITRE's observed example is CVE-2002-0267: a linebreak in a field of a PHP script allows admin privileges when written to a data file.
// Vulnerable: the value is trusted to be a single line
$line = $username . ":" . $level . "\n";
file_put_contents("access.cfg", $line, FILE_APPEND);
// $username = "eve:1" . "\n" . "eve" would write a second, higher entry
As MITRE notes, an injected, absent or malformed delimiter may cause the process to take unexpected actions. The difference from record delimiters (CWE-143) is mostly one of naming. Records and lines often coincide, so the fixes are the same.
What an attacker gains
The listed consequence is an integrity impact with an unexpected state. The attacker adds configuration lines, forges log entries, or alters what a line-oriented parser sees. The example above shows privilege assignment.
How to find it
- Search for writes of external values into line-oriented outputs.
- Send CR, LF and CRLF, plus the Unicode line separators your platform may treat as breaks, and check the result.
- Check how each downstream consumer defines a line, since conventions differ.
How to fix it
- Remove or reject line break characters in single-line fields.
- Use a serializer or library that encodes line breaks for the format.
- Do not build line-based files by string concatenation when the content comes from users.
- Validate with an allow list of expected characters.
Quick check
Is checking for just a line feed enough?
No. Carriage return and carriage return plus line feed also end lines in many systems. Reject or encode all of them.
