PT-2023-20526 · Unknown · Ithewei/Libhv

Alessio Della Libera · Publicado 2023-09-28 · Atualizado 2023-10-02 · CVE-2023-26148

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ithewei/libhv versions all

Description The issue affects the ithewei/libhv package, where untrusted user input used to set request headers can lead to CRLF Injection. An attacker can inject additional headers into the request by adding carriage return line feeds (r ) characters.

Recommendations For all versions, consider restricting the use of untrusted user input in setting request headers until a patch is available. As a temporary workaround, validate and sanitize all user input to prevent the injection of malicious characters, such as r .

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

CWE-93

Identificadores relacionados

CVE-2023-26148

Produtos afetados

Ithewei/Libhv

Referências · 6

• 🔥 https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e · Exploit
• https://osv.dev/vulnerability/CVE-2023-26148 · Aviso do Fabricante
• https://t.me/cibsecurity/71266 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26148 · Nota de Segurança
• https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769 · Nota
• https://twitter.com/CVEnew/status/1707624916693008827 · Publicação no Twitter