PT-2024-34666 · .Net · Refit

Sofiaml · Published 2024-11-04 · Updated 2025-01-13 · CVE-2024-51501

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Refit versions prior to 7.2.22 Refit versions prior to 8.0.0

Description The Refit library for .NET Core, Xamarin, and .NET has a CRLF injection vulnerability in its header-related attributes. This vulnerability occurs because the HttpHeaders.TryAddWithoutValidation method does not check for CRLF characters in the header value, allowing an attacker to inject additional HTTP headers or smuggle whole HTTP requests. If an application using the Refit library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection, which can lead to request splitting and Server Side Request Forgery (SSRF).

Recommendations For Refit versions prior to 7.2.22, upgrade to version 7.2.22 or later. For Refit versions prior to 8.0.0, upgrade to version 8.0.0 or later. As a temporary workaround, consider avoiding the use of the HttpHeaders.TryAddWithoutValidation method and instead use a validated method to add headers to requests. Restrict access to user-controllable header values to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1395

CWE-93

Related Identifiers

CVE-2024-51501

GHSA-3HXG-FXWM-8GF7

GHSA-MGR7-5782-6JH9

Affected Products

Refit

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51501.json · Exploit
• https://osv.dev/vulnerability/GHSA-3hxg-fxwm-8gf7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51501 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51501 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mgr7-5782-6jh9 · Vendor Advisory
• https://github.com/reactiveui/refit/security/advisories/GHSA-3hxg-fxwm-8gf7 · Note
• https://github.com/reactiveui/refit/blob/258a771f44417c6e48e103ac921fe4786f3c2a1e/Refit/RequestBuilderImplementation.cs#L1328 · Note
• https://github.com/reactiveui/refit · Note
• https://github.com/reactiveui/refit/commit/483b1d8df18098f137ca0eca056b7e9ec19f70dd · Note
• https://github.com/umbraco/Umbraco.Headless.Client.Net · Note
• https://github.com/umbraco/Umbraco.Headless.Client.Net/security/advisories/GHSA-mgr7-5782-6jh9 · Note
• https://twitter.com/CCBalert/status/1856398258907832518 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1853681762972418558 · Twitter Post
• https://twitter.com/CVEnew/status/1853577242577719585 · Twitter Post
• https://t.me/cvedetector/9800 · Telegram Post