PT-2023-32955 · Unknown · Codeigniter

Neznaika0 · Published 2023-04-19 · Updated 2025-08-01 · CVE-2025-24013

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.5.8

Description The issue is related to improper header validation for the name and value, which could allow a potential attacker to construct deliberately malformed headers using the Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.

Recommendations For CodeIgniter versions prior to 4.5.8, update to version 4.5.8 to resolve the issue. As a temporary workaround, consider restricting the use of the Header class to minimize the risk of exploitation. Avoid using the character in header names and values until the issue is resolved.

Exploit

Fix

DoS

Weakness Enumeration

CWE-436

Related Identifiers

BDU:2025-01640

CVE-2025-24013

GHSA-WXMH-65F7-JCVW

GHSA-X5MQ-JJR3-VMX6

Affected Products

Codeigniter

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24013.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2023-29197.yaml · Exploit
• https://github.com/codeigniter4/CodeIgniter4/commit/5f8aa24280fb09947897d6b322bf1f0e038b13b6 · Patch
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-x5mq-jjr3-vmx6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24013 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5mq-jjr3-vmx6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wxmh-65f7-jcvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29197 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24013 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01640 · Security Note
• https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 · Note
• https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw · Note
• https://github.com/guzzle/psr7 · Note