PT-2023-3153 · Yhirose · Cpp-Httplib

Alessio Della Libera · Publicado 2023-05-30 · Atualizado 2024-10-28 · CVE-2023-26130

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yhirose/cpp-httplib versions prior to 0.12.4

Description The issue is related to the incomplete fix for a previous problem, which allows an attacker to inject arbitrary HTTP headers when untrusted user input is used to set the content-type header in HTTP requests, such as .Patch, .Post, .Put, and .Delete. This can lead to logical errors and other misbehaviors. The vulnerability is due to the lack of measures to neutralize CRLF sequences.

Recommendations For versions prior to 0.12.4, update to version 0.12.4 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user input for the content-type header to prevent CRLF injection. Restrict access to the HTTP .Patch, .Post, .Put, and .Delete requests until the issue is resolved.

Correção

Special Elements Injection

Command Injection

Enumeração de Fraquezas

CWE-74

CWE-77

CWE-93

Identificadores relacionados

BDU:2023-03252

CVE-2023-26130

OESA-2023-1364

OESA-2023-1365

Produtos afetados

Cpp-Httplib

Referências · 23

• https://github.com/yhirose/cpp-httplib/commit/5b397d455d25a391ba346863830c1949627b4d08 · Correção
• https://github.com/yhirose/cpp-httplib/releases/tag/v0.12.4 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26130 · Aviso do Fabricante
• https://t.me/cvenotify/78797 · Publicação no Telegram
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1364 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26130 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2RY6PKBU73I45L6YWNYCUK2XBEXEFX7L · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26130 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03252 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/U6MO4FSKYNSAJVUXYP7LRY7ARUIGKBFL · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-26130 · Nota de Segurança
• https://osv.dev/vulnerability/OESA-2023-1364 · Aviso do Fabricante
• https://t.me/cvenotify/99799 · Publicação no Telegram
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NYODHZECXYFC2BNODZPZXZAXOKGMCYAP · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26130 · Aviso do Fabricante