PT-2020-19659 · Io.Jooby · Io.Jooby:Jooby-Netty

Jonathan Leitschuh · Published 2020-04-03 · Updated 2021-08-03 · CVE-2020-7622

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions io.jooby:jooby-netty versions 1.6.9 and earlier, versions 2.0.0 through 2.2.0

Description This issue affects the DefaultHttpHeaders setting, which is set to false, allowing potential abuse for HTTP Response Splitting. The vulnerability can lead to Cross Site Scripting, Cache Poisoning, and Page Hijacking. It is caused by the improper neutralization of CRLF sequences in HTTP headers. The root cause is linked to a specific line in the Jooby codebase where the DefaultHttpHeaders takes a parameter validate which, when set to true, validates that the header isn't being abused for HTTP Response Splitting.

Recommendations For versions 1.6.9 and earlier, update to version 2.2.1 or later. For versions 2.0.0 through 2.2.0, update to version 2.2.1. As a temporary workaround, ensure that user-supplied data isn't able to flow to HTTP headers, and pre-sanitize for CRLF characters if it does.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2020-7622

GHSA-GV3V-92V6-M48J

SNYK-JAVA-IOJOOBY-564249

Affected Products

Io.Jooby:Jooby-Netty

References · 7

• 🔥 https://github.com/jooby-project/jooby/security/advisories/GHSA-gv3v-92v6-m48j · Exploit
• https://github.com/jooby-project/jooby/commit/b66e3342cf95205324023cfdf2cb5811e8a6dcf4 · Patch
• https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249 · Patch
• https://osv.dev/vulnerability/CVE-2020-7622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7622 · Security Note
• https://osv.dev/vulnerability/GHSA-gv3v-92v6-m48j · Vendor Advisory
• https://t.me/cvenotify/2434 · Telegram Post