CVE-2017-1000247: CodeIgniter HTTP Header Injection
Summary
CVE-2017-1000247: CodeIgniter HTTP Header Injection. Affects codeigniter4/framework versions >= 3.1.3, < 3.1.4. Fixed in 3.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a popular PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process. The vulnerability affects CodeIgniter version 3.1.3 and allows for HTTP Header Injection in the set_status_header() function under Apache. This vulnerability can lead to HTTP Header Injection flaws, potentially enabling attackers to manipulate HTTP headers and perform various attacks.
Vulnerability Detail
The vulnerability in CodeIgniter version 3.1.3 arises from a lack of proper input validation in the set_status_header() function. This allows an attacker to inject malicious content into the HTTP headers, leading to potential security issues. An attacker could exploit this vulnerability to perform attacks such as HTTP response splitting, cache poisoning, or cross-site scripting (XSS). The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
3.1.4
This is the first release that contains the fix.
composer require codeigniter4/framework:3.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by upgrading to the latest version of CodeIgniter.
Conclusion
CodeIgniter version 3.1.3 is vulnerable to HTTP Header Injection, which can lead to various security issues. It is crucial to upgrade to the latest version of CodeIgniter (3.1.4 or later) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codeigniter4/framework →
FAQ
CodeIgniter is a PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process.
HTTP Header Injection is a web security vulnerability that allows an attacker to manipulate HTTP headers, potentially leading to various attacks such as HTTP response splitting, cache poisoning, or cross-site scripting (XSS).
An attacker can exploit this vulnerability by injecting malicious content into the HTTP headers, potentially leading to security issues and enabling various attacks.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
To fix this vulnerability, it is recommended to upgrade to CodeIgniter version 3.1.4 or later, as it includes a fix for the HTTP Header Injection issue.
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
