CVE-2019-10797: HTTP Response Splitting in WSO2 transport-http
Summary
CVE-2019-10797: HTTP Response Splitting in WSO2 transport-http. Affects org.wso2.transport.http:org.wso2.transport.http.netty versions < 6.3.1. Fixed in 6.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The WSO2 transport-http package is a Maven package that provides HTTP transport capabilities for WSO2 products. It includes the org.wso2.transport.http.netty package, which is responsible for handling HTTP communication using Netty. Netty is a popular Java framework for building high-performance network applications. However, versions of WSO2 transport-http prior to v6.3.1 are vulnerable to HTTP Response Splitting due to the disabling of HTTP Header validation.
Vulnerability Detail
HTTP Response Splitting is a web security vulnerability that allows an attacker to inject malicious HTTP headers into a response. This can lead to various attacks, such as cache poisoning, cross-site scripting (XSS), and session hijacking. In the case of WSO2 transport-http, the vulnerability arises from the lack of validation of HTTP headers, which enables an attacker to manipulate the response and potentially deceive the client or perform other malicious actions.
How To Fix
Minimum fixed version
6.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the HTTP headers in the application code. This can involve checking for and removing any potentially malicious characters or sequences in the headers before sending the response. However, it is strongly advised to upgrade to the fixed version as soon as possible to ensure comprehensive protection against HTTP Response Splitting attacks.
Conclusion
The vulnerability in the WSO2 transport-http package exposes applications to the risk of HTTP Response Splitting attacks. To mitigate this risk, it is crucial to upgrade to version 6.3.1 or later of the package, which includes the necessary fixes. Alternatively, a temporary workaround can be implemented by manually validating and sanitizing the HTTP headers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.wso2.transport.http:org.wso2.transport.http.netty →
FAQ
HTTP Response Splitting is a web security vulnerability that allows an attacker to inject malicious HTTP headers into a response. This can lead to various attacks, such as cache poisoning, cross-site scripting (XSS), and session hijacking.
The vulnerability in the WSO2 transport-http package arises from the disabling of HTTP Header validation. This allows an attacker to manipulate the response and potentially deceive the client or perform other malicious actions.
HTTP Response Splitting can lead to various attacks, including cache poisoning, cross-site scripting (XSS), and session hijacking. These attacks can compromise the integrity and security of the application and its users.
To fix this vulnerability, it is recommended to upgrade to version 6.3.1 or later of the WSO2 transport-http package. This version includes the necessary fixes and enables proper validation of HTTP headers to prevent HTTP Response Splitting attacks.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the HTTP headers in the application code. This involves checking for and removing any potentially malicious characters or sequences in the headers before sending the response.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
