CVE-2018-1067: Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow
Summary
CVE-2018-1067: Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow. Affects org.jboss.eap:wildfly-undertow versions < 7.1.2.GA. Fixed in 7.1.2.GA. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2018-1067 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a web server implemented in Java that is used by the org.jboss.eap:wildfly-undertow package. It provides a lightweight and high-performance foundation for building web applications. Undertow is vulnerable to the injection of arbitrary HTTP headers and response splitting due to insufficient sanitization and validation of user input before it is used as part of an HTTP header value.
Vulnerability Detail
The vulnerability (CVE-2018-1067) in Undertow allows an attacker to inject arbitrary HTTP headers and perform response splitting attacks. This can lead to various security issues, such as cross-site scripting (XSS), session hijacking, and cache poisoning. The vulnerability arises from the lack of proper sanitization and validation of user input before it is used in constructing HTTP headers. An attacker can exploit this vulnerability by injecting malicious input that includes CRLF sequences, which can alter the intended behavior of the web server.
How To Fix
Minimum fixed version
7.1.2.GA
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to implement input validation and sanitization mechanisms in the application code. This can involve using appropriate libraries or frameworks that handle input validation and sanitization, as well as enforcing strict input validation rules to prevent the injection of malicious input.
Conclusion
The vulnerability in Undertow allows for the injection of arbitrary HTTP headers and response splitting attacks. It is crucial to upgrade the org.jboss.eap:wildfly-undertow package to the fixed version or implement appropriate input validation and sanitization mechanisms to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jboss.eap:wildfly-undertow →
FAQ
The vulnerability allows an attacker to inject arbitrary HTTP headers and perform response splitting attacks. This can lead to security issues such as cross-site scripting (XSS), session hijacking, and cache poisoning.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Yes, upgrading the org.jboss.eap:wildfly-undertow package to version 7.1.2.GA or later includes a fix for this vulnerability.
A temporary workaround is to implement input validation and sanitization mechanisms in the application code to prevent the injection of malicious input.
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.eap:wildfly-undertow.
