Arbitrary HTTP Header Injection in Undertow: CVE-2018-1067
Summary
CVE-2018-1067: In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, du... Affects undertow across 2 version ranges.
< 1.4.25-1
< 5d57f1321e86209a30626e6a35d9cf9a063766fc
Fixed in 1.4.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Undertow is a flexible and performant web server written in Java, designed for handling both blocking and non-blocking requests. It is commonly used in Java applications for its lightweight architecture and ability to serve both static and dynamic content. However, prior to versions 7.1.2.CR1 and 7.1.2.GA, Undertow was found to be vulnerable to an injection of arbitrary HTTP headers, which could lead to serious security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1067, stems from an incomplete fix for a previous vulnerability (CVE-2016-4993). It allows attackers to inject arbitrary HTTP headers and perform response splitting due to insufficient sanitization and validation of user input. This could lead to various attacks, including cache poisoning, cross-site scripting (XSS), and other forms of injection attacks. The technical aspect of this vulnerability lies in the way Undertow processes user input before it is included in HTTP headers, making it susceptible to exploitation.
How To Fix
Minimum fixed version
1.4.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade undertowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on their own before passing user input to Undertow. This may include stripping out or encoding potentially harmful characters from user input that could be used in HTTP headers.
Conclusion
CVE-2018-1067 is a significant vulnerability affecting Undertow, allowing for arbitrary HTTP header injection due to inadequate input validation. Users are strongly advised to update to the latest patched version to secure their applications. For those unable to update immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for undertow →
FAQ
CVE-2018-1067 is a vulnerability in the Undertow web server that allows for arbitrary HTTP header injection and response splitting due to insufficient input validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The impacts include cache poisoning, cross-site scripting (XSS), and other injection attacks, which can compromise the security of web applications.
Yes, a patch is available. Users should upgrade to Undertow version 1.4.25-1 or later to mitigate this vulnerability.
If immediate updating is not possible, implement input validation and sanitization as a temporary workaround to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for undertow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
