CVE-2024-51501
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
Summary
Refit, an automatic type-safe REST library for .NET Core, Xamarin and .NET, has a vulnerability where the various header-related attributes (Header, HeaderCollection and Authorize) are susceptible to CRLF injection. The issue stems from the use of the `HttpHeaders.TryAddWithoutValidation` method, which does not check for CRLF characters in header values. This vulnerability allows for the injection of additional HTTP headers or the smuggling of whole HTTP requests when using HTTP/1.1.
Impact
If an application using the Refit library passes user-controllable values to headers, it becomes vulnerable to CRLF injection. In web applications, this can lead to request splitting, making the application susceptible to Server Side Request Forgery (SSRF). While this may not be a significant security issue for command-line applications, it poses a considerable risk in web application contexts. The vulnerability has a CVSS v4 base score of 10.0, which is rated as CRITICAL severity.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been addressed in release version 8.0.0 of Refit. All users are advised to upgrade to this version or later.
Mitigation
The primary mitigation is to upgrade to Refit version 8.0.0 or later, which addresses this vulnerability. There are no known workarounds for this issue other than upgrading. Users should prioritize this update, especially for web applications using Refit. Additionally, as a general security practice, applications should avoid passing user-controllable values directly to HTTP headers without proper validation and sanitization.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
NVD published the first details for CVE-2024-51501
A CVSS base score of 2.3 has been assigned.
Feedly found the first article mentioning CVE-2024-51501. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 10%)
A CVSS base score of 2.3 has been assigned.
A CVSS base score of 10 has been assigned.