// For flags

CVE-2023-0040

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.

Las versiones de Async HTTP Client anteriores a la 1.13.2 son vulnerables a una forma de manipulación de solicitudes dirigida llamada inyección CRLF. Esta vulnerabilidad fue el resultado de una validación insuficiente de los valores de los campos del encabezado HTTP antes de enviarlos a la red. Los usuarios son vulnerables si pasan datos que no son de confianza a valores de campos de encabezado HTTP sin una desinfección previa. Los casos de uso comunes aquí podrían ser colocar nombres de usuario de una base de datos en campos de encabezado HTTP. Esta vulnerabilidad permite a los atacantes inyectar nuevos campos de encabezado HTTP o solicitudes completamente nuevas en el flujo de datos. Esto puede hacer que el servidor remoto comprenda las solicitudes de forma muy diferente a la prevista. En general, es poco probable que esto dé lugar a la divulgación de datos, pero puede dar lugar a una serie de errores lógicos y otras malas conductas.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-01-03 CVE Reserved
  • 2023-01-18 CVE Published
  • 2024-06-30 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Asynchttpclient Project
Search vendor "Asynchttpclient Project"
Async-http-client
Search vendor "Asynchttpclient Project" for product "Async-http-client"
< 1.4.1
Search vendor "Asynchttpclient Project" for product "Async-http-client" and version " < 1.4.1"
-
Affected
Asynchttpclient Project
Search vendor "Asynchttpclient Project"
Async-http-client
Search vendor "Asynchttpclient Project" for product "Async-http-client"
>= 1.5.0 < 1.9.1
Search vendor "Asynchttpclient Project" for product "Async-http-client" and version " >= 1.5.0 < 1.9.1"
-
Affected
Asynchttpclient Project
Search vendor "Asynchttpclient Project"
Async-http-client
Search vendor "Asynchttpclient Project" for product "Async-http-client"
>= 1.10.0 < 1.12.1
Search vendor "Asynchttpclient Project" for product "Async-http-client" and version " >= 1.10.0 < 1.12.1"
-
Affected
Asynchttpclient Project
Search vendor "Asynchttpclient Project"
Async-http-client
Search vendor "Asynchttpclient Project" for product "Async-http-client"
>= 1.13.0 < 1.13.2
Search vendor "Asynchttpclient Project" for product "Async-http-client" and version " >= 1.13.0 < 1.13.2"
-
Affected