PT-2021-23077 · Http4S · Http4S
Published
2021-09-21
·
Updated
2022-10-25
·
CVE-2021-41084
CVSS v3.1
8.7
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
http4s versions prior to 0.21.30
http4s versions prior to 0.22.5
http4s versions prior to 0.23.4
http4s versions prior to 1.0.0-M27
Description
http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create certain fields, including
Header.name, Header.value, Status.reason, Uri.Path, and URI.RegName. This issue can be exploited by malicious users to hijack responses from the server and return different content. The carriage return, newline, and null characters are the most threatening. As a matter of practice, http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend.Recommendations
For versions prior to 0.21.30, update to version 0.21.30 or later.
For versions prior to 0.22.5, update to version 0.22.5 or later.
For versions prior to 0.23.4, update to version 0.23.4 or later.
For versions prior to 1.0.0-M27, update to version 1.0.0-M27 or later.
As a temporary workaround, consider sanitizing any user input in the aforementioned fields before returning a request or response to the backend, by replacing null, carriage return, and newline characters with space characters.
Exploit
Fix
SSRF
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Http4S