CRLF Injection Vulnerability in CGit: Arbitrary HTTP Header Injection Risk
Summary
CVE-2016-1900: CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP r... Affects cgit across 3 version ranges.
< 0.11.2.git2.3.2-1.1
< 513b3863d999f91b47d7e9f26710390db55f9463
< cadbb69990d232ce49547190b1cff2b57fc8b438
Fixed in 0.11.2.git2.3.2-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CGit is a web interface for Git repositories, allowing users to browse and manage repositories through a web browser. It is widely used due to its lightweight nature and ease of integration with existing Git setups. However, a critical vulnerability exists in CGit versions prior to 0.12, which allows attackers with write permissions to inject arbitrary HTTP headers into responses, leading to potential security risks.
Vulnerability Detail
The CRLF injection vulnerability in CGit arises from improper handling of newline characters in filenames within the cgit_print_http_headers function in ui-shared.c. This flaw enables remote attackers to manipulate HTTP responses, potentially leading to HTTP response splitting attacks or cross-site scripting (XSS) attacks. The vulnerability can be exploited by crafting malicious filenames that include newline characters, which can disrupt the intended HTTP response structure.
How To Fix
Minimum fixed version
0.11.2.git2.3.2-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cgitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting write permissions to the repository for untrusted users to mitigate the risk of exploitation. Additionally, validate and sanitize filenames to ensure they do not contain newline characters.
Conclusion
The CRLF injection vulnerability in CGit poses significant risks to users with write permissions. It is crucial to upgrade to the fixed version to mitigate potential attacks. Employing Vulert can help monitor for such vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for cgit →
FAQ
CRLF injection is a type of attack that exploits the way web servers handle newline characters, allowing attackers to inject arbitrary HTTP headers into responses.
Any user or organization using CGit versions prior to 0.12 with write permissions to their repositories is at risk.
Exploitation can lead to HTTP response splitting, which may allow attackers to perform XSS attacks, redirect users, or manipulate web content.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 3.7, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for cgit.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
