PT-2020-17383 · Dart · Http Package

N0Npax · Published 2020-12-24 · Updated 2023-03-22 · CVE-2020-35669

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions http package versions 0.12.2 and earlier http package versions prior to 0.13.3

Description An issue was discovered in the http package for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request via HTTP header injection.

Recommendations For versions 0.12.2 and earlier, update to version 0.13.3 or later to address the issue. For versions prior to 0.13.3, update to version 0.13.3 or later to address the issue. As a temporary workaround, consider validating request methods to prevent CRLF injection in HTTP requests.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-35669

GHSA-4RGH-JX4F-QFCQ

Affected Products

Http Package

References · 13

• 🔥 https://github.com/dart-lang/http/issues/511 · Exploit
• https://osv.dev/vulnerability/CVE-2020-35669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35669 · Security Note
• https://osv.dev/vulnerability/GHSA-4rgh-jx4f-qfcq · Vendor Advisory
• https://github.com/dart-lang/http/blob/master/CHANGELOG.md#0133 · Note
• https://github.com/dart-lang/http · Note
• https://github.com/dart-lang/http/commit/abb2bb182fbd7f03aafd1f889b902d7b3bdb8769 · Note
• https://github.com/dart-lang/http/pull/512 · Note
• https://t.me/cvenotify/7687 · Telegram Post
• https://t.me/cibsecurity/21258 · Telegram Post
• https://t.me/cvenotify/46668 · Telegram Post
• https://pub.dev/packages/http/changelog#0133 · Note
• https://t.me/cvenotify/33378 · Telegram Post