CRLF Injection Vulnerability in CGit: Remote Header Injection Risk
Summary
DEBIAN-CVE-2016-1899: CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF... Affects cgit versions < 0.11.2.git2.3.2-1.1. Fixed in 0.11.2.git2.3.2-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CGit is a web interface for Git repositories that allows users to browse repositories and manage their content through a web browser. It is designed to be lightweight and efficient, providing features such as repository browsing, commit history viewing, and file downloading. However, CGit versions prior to 0.12 are susceptible to a CRLF injection vulnerability, which can lead to serious security issues, including HTTP response splitting and cross-site scripting (XSS) attacks.
Vulnerability Detail
The CRLF injection vulnerability in CGit arises from improper handling of the 'mimetype' parameter in the ui-blob handler. Attackers can exploit this flaw by injecting CRLF sequences into the parameter, allowing them to manipulate HTTP headers. This can lead to unauthorized actions such as HTTP response splitting, where an attacker can craft a malicious response that could be executed in the context of the victim's browser, potentially leading to XSS attacks. The vulnerability is identified as DEBIAN-CVE-2016-1899.
How To Fix
Minimum fixed version
0.11.2.git2.3.2-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cgitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to validate and sanitize inputs to the 'mimetype' parameter to prevent CRLF sequences from being processed. This can be implemented by adding input validation checks in the application code to reject any input containing CRLF sequences.
Conclusion
The CRLF injection vulnerability in CGit poses significant risks to applications that utilize this package. By understanding the nature of the vulnerability and taking appropriate steps to update or mitigate the risk, developers can protect their applications from potential attacks. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for cgit →
FAQ
CRLF injection is a type of attack that allows an attacker to inject carriage return (CR) and line feed (LF) characters into HTTP headers, potentially manipulating the response sent to the client.
Exploiting this vulnerability can lead to unauthorized HTTP responses, which may include malicious scripts executed in the user's browser, resulting in XSS attacks.
If you are using CGit version prior to 0.12, your application is vulnerable to this issue. It is recommended to upgrade to the latest version.
If an immediate update is not possible, implement input validation and sanitization for the 'mimetype' parameter as a temporary measure to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for cgit.
