CVE-2023-0040: CRLF Injection vulnerability in Async HTTP Client
Summary
CVE-2023-0040: Async HTTP Client has CRLF Injection vulnerability in HTTP request headers. Affects github.com/swift-server/async-http-client across 4 version ranges.
< 1.4.1
>= 1.5.0, < 1.9.1
>= 1.10.0, < 1.12.1
>= 1.13.0, < 1.13.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Async HTTP Client is a Swift package that provides an asynchronous HTTP client library for making HTTP requests. It is commonly used in Swift applications to interact with web servers. The package allows users to send HTTP requests and receive responses asynchronously, making it efficient for handling concurrent network operations. However, versions prior to 1.13.2 are vulnerable to a CRLF injection vulnerability in HTTP request headers.
Vulnerability Detail
The CRLF injection vulnerability in Async HTTP Client arises from a lack of validation of HTTP header field values before sending them to the network. This vulnerability can be exploited when untrusted data is passed into HTTP header field values without proper sanitization. Attackers can inject new HTTP header fields or entirely new requests into the data stream, causing the remote server to interpret the requests differently than intended. While data disclosure is unlikely, this vulnerability can lead to logical errors and other misbehaviors.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.4.11.4.1 -
>= 1.5.0, < 1.9.11.9.1 -
>= 1.10.0, < 1.12.11.12.1 -
>= 1.13.0, < 1.13.21.13.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The CRLF injection vulnerability in Async HTTP Client can be mitigated by upgrading to version 1.13.2 or later. It is crucial to keep dependencies up to date and sanitize user input to prevent similar vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/swift-server/async-http-client →
FAQ
Async HTTP Client is a Swift package that provides an asynchronous HTTP client library for making HTTP requests. It is commonly used in Swift applications to interact with web servers.
CRLF injection is a form of targeted request manipulation where attackers can inject new HTTP header fields or entirely new requests into the data stream. This can cause the remote server to interpret the requests differently than intended.
While data disclosure is unlikely, this vulnerability can lead to logical errors and other misbehaviors. It can disrupt the normal functioning of the application and potentially impact the integrity of the data being transmitted.
To fix this vulnerability, it is recommended to upgrade to version 1.13.2 or later of Async HTTP Client. Additionally, sanitize any user input or untrusted data before using it in HTTP header field values.
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
