PT-2023-3153 · Yhirose · Cpp-Httplib

Alessio Della Libera · Published 2023-05-30 · Updated 2024-10-28 · CVE-2023-26130

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yhirose/cpp-httplib versions prior to 0.12.4

Description The issue is related to the incomplete fix for a previous problem, which allows an attacker to inject arbitrary HTTP headers when untrusted user input is used to set the content-type header in HTTP requests, such as .Patch, .Post, .Put, and .Delete. This can lead to logical errors and other misbehaviors. The vulnerability is due to the lack of measures to neutralize CRLF sequences.

Recommendations For versions prior to 0.12.4, update to version 0.12.4 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user input for the content-type header to prevent CRLF injection. Restrict access to the HTTP .Patch, .Post, .Put, and .Delete requests until the issue is resolved.

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

CWE-93

Related Identifiers

BDU:2023-03252

CVE-2023-26130

OESA-2023-1364

OESA-2023-1365

Affected Products

Cpp-Httplib

References · 23

• https://github.com/yhirose/cpp-httplib/commit/5b397d455d25a391ba346863830c1949627b4d08 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26130 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26130 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2RY6PKBU73I45L6YWNYCUK2XBEXEFX7L · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26130 · Security Note
• https://bdu.fstec.ru/vul/2023-03252 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/U6MO4FSKYNSAJVUXYP7LRY7ARUIGKBFL · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26130 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1364 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NYODHZECXYFC2BNODZPZXZAXOKGMCYAP · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26130 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1365 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JY2E7EIRWQMKH6GY4OZOWWBZBY3Q7CGS · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26130 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26130 · Vendor Advisory