PT-2024-19995 · Unknown · Trillium-Http+1
Divergentdave
·
Published
2024-01-23
·
Updated
2024-02-02
·
CVE-2024-23644
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
trillium-http versions prior to 0.3.12
trillium-client versions prior to 0.5.4
Description
Insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have sufficient control over headers. This only affects use cases where attackers have control of request headers, and can insert "r
" sequences. Specifically, if untrusted and unvalidated input is inserted into header names or values. Outbound
trillium http::HeaderValue and trillium http::HeaderName can be constructed infallibly and were not checked for illegal bytes when sending requests from the client or responses from the server. Thus, if an attacker has sufficient control over header values (or names) in a request or response that they could inject r sequences, they could get the client and server out of sync, and then pivot to gain control over other parts of requests or responses.Recommendations
For trillium-http versions prior to 0.3.12, update to version 0.3.12 or later.
For trillium-client versions prior to 0.5.4, update to version 0.5.4 or later.
As a temporary workaround, Trillium services and client applications should sanitize or validate untrusted input that is included in header values and header names. Carriage return, newline, and null characters are not allowed.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Trillium-Client
Trillium-Http