PT-2023-20526 · Unknown · Ithewei/Libhv

Alessio Della Libera · Published 2023-09-28 · Updated 2023-10-02 · CVE-2023-26148

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ithewei/libhv versions all

Description The issue affects the ithewei/libhv package, where untrusted user input used to set request headers can lead to CRLF Injection. An attacker can inject additional headers into the request by adding carriage return line feeds (r ) characters.

Recommendations For all versions, consider restricting the use of untrusted user input in setting request headers until a patch is available. As a temporary workaround, validate and sanitize all user input to prevent the injection of malicious characters, such as r .

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-93

Related Identifiers

CVE-2023-26148

Affected Products

Ithewei/Libhv

References · 6

• 🔥 https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e · Exploit
• https://osv.dev/vulnerability/CVE-2023-26148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26148 · Security Note
• https://t.me/cibsecurity/71266 · Telegram Post
• https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769 · Note
• https://twitter.com/CVEnew/status/1707624916693008827 · Twitter Post