CRLF Injection Vulnerability in cpp-httplib: A Critical Security Flaw
Summary
CVE-2023-26130: Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. Affects cpp-httplib across 3 version ranges.
< 0.11.4+ds-1+deb12u1
< 5b397d455d25a391ba346863830c1949627b4d08
< 3409c00e6f5402eb4e300b45e44e11c3bdfe1a5c
Fixed in 0.11.4+ds-1+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++ header-only library designed for HTTP/HTTPS requests. It is lightweight and easy to integrate, making it popular for applications requiring network communication. However, certain versions of cpp-httplib are vulnerable to CRLF injection, which can lead to logical errors and misbehavior when untrusted user input is used to set the content-type header in HTTP requests.
Vulnerability Detail
The vulnerability, identified as CVE-2023-26130, affects versions of cpp-httplib prior to 0.12.4. It arises from an incomplete fix for a previous vulnerability (CVE-2020-11709) and allows attackers to exploit the content-type header in HTTP methods such as Patch, Post, Put, and Delete. This can result in severe consequences, including the potential for unauthorized actions and data manipulation, as the application may misinterpret the headers due to the injection.
How To Fix
Minimum fixed version
0.11.4+ds-1+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cpp-httplibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing user input to ensure that no CRLF characters are included in the content-type header. This can be done by implementing a validation function that checks for and removes any newline characters from the input before it is processed.
Conclusion
The CRLF injection vulnerability in cpp-httplib poses a significant risk to applications using this library. It is crucial to upgrade to the latest version to protect against potential exploits. Additionally, implementing input validation can serve as a temporary measure to mitigate risks until an upgrade can be performed.
See every vulnerability recorded for cpp-httplib →
FAQ
CRLF injection is a type of attack where an attacker can insert CR (Carriage Return) and LF (Line Feed) characters into HTTP headers, potentially altering the behavior of the application.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to logical errors, unauthorized actions, and data manipulation within the application.
Yes, you should upgrade to cpp-httplib version 0.12.4 or later to mitigate this vulnerability.
Implement input validation to sanitize user input, ensuring that no CRLF characters are included in the content-type header.
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
