CVE-2016-3166: Drupal CRLF Injection Vulnerability in drupal_set_header
Summary
CVE-2016-3166: Drupal CRLF injection vulnerability in the drupal_set_header function. Affects drupal/core versions >= 6.0, < 6.38. Fixed in 6.38. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, is vulnerable to CRLF injection. This vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. The vulnerability arises when a module allows user-submitted data to appear in HTTP headers.
Vulnerability Detail
The CRLF injection vulnerability in the drupal_set_header function can be exploited by remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. By leveraging a module that allows user-submitted data to appear in HTTP headers, an attacker can manipulate the headers sent by the server and potentially trick users into performing unintended actions or disclosing sensitive information. This vulnerability is considered moderate in severity with a CVSS score of 5.9.
How To Fix
Minimum fixed version
6.38
This is the first release that contains the fix.
composer require drupal/core:6.38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Drupal is not immediately feasible, a temporary workaround is to disable or remove any modules that allow user-submitted data to appear in HTTP headers. By removing these modules, the attack surface for the CRLF injection vulnerability is reduced. However, this workaround may impact the functionality of the affected modules, so it is important to assess the impact before implementing this workaround.
Conclusion
The CRLF injection vulnerability in the drupal_set_header function of Drupal can be exploited by remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. It is recommended to upgrade to Drupal version 6.38 or later to fix this vulnerability. If immediate upgrading is not possible, consider disabling or removing modules that allow user-submitted data to appear in HTTP headers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications.
CRLF injection is a web application vulnerability that allows an attacker to inject arbitrary HTTP headers. This can lead to HTTP response splitting attacks, where the attacker manipulates the headers sent by the server to trick users or perform other malicious actions.
The CRLF injection vulnerability in Drupal allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This can potentially lead to various security risks, such as session hijacking, cross-site scripting (XSS), or information disclosure.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Drupal installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
You can find more information about this vulnerability in the Drupal security advisory: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
