CVE-2018-12537: Vulnerability in io.vertx:vertx-core
Summary
CVE-2018-12537: Moderate severity vulnerability that affects io.vertx:vertx-core. Affects io.vertx:vertx-core versions >= 3.0.0, < 3.5.2. Fixed in 3.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.vertx:vertx-core package is a core component of Eclipse Vert.x, a toolkit for building reactive applications on the Java Virtual Machine. It provides a set of APIs for creating high-performance, event-driven applications. This vulnerability affects versions 3.0 to 3.5.1 of the package.
Vulnerability Detail
The vulnerability in io.vertx:vertx-core allows unfiltered values to inject a new header in the client request or server response. Specifically, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This can lead to header injection attacks, potentially enabling an attacker to manipulate or spoof headers, perform cross-site scripting (XSS) attacks, or bypass security controls.
How To Fix
Minimum fixed version
3.5.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround is to manually sanitize the header values by removing any carriage return and line feed characters before setting them in the HttpServer response headers or HttpClient request headers. Here's an example in Java:
String sanitizedValue = originalValue.replaceAll("[\r\n]+", "");
headers.set("Header-Name", sanitizedValue);
Note that this workaround should be used with caution and upgrading to a fixed version is still strongly recommended.
Conclusion
In conclusion, the vulnerability in io.vertx:vertx-core allows for header injection attacks, potentially leading to various security issues. It is recommended to upgrade to version 3.5.2 or later to fix this vulnerability. If immediate upgrade is not possible, manual sanitization of header values can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.vertx:vertx-core →
FAQ
The vulnerability allows for header injection attacks, which can lead to various security issues such as manipulation or spoofing of headers, cross-site scripting (XSS) attacks, and bypassing security controls.
Versions 3.0 to 3.5.1 of io.vertx:vertx-core are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and it will analyze and alert you in real-time.
Yes, upgrading to version 3.5.2 or later of io.vertx:vertx-core will fix this vulnerability.
If upgrading to a fixed version is not immediately possible, you can manually sanitize the header values by removing carriage return and line feed characters before setting them in the HttpServer response headers or HttpClient request headers.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-core.
