Oxid eShop up to 4.7.10 HTTP Response crlf injection

Summaryinfo

A vulnerability was found in Oxid eShop and classified as critical. This affects an unknown function. Executing a manipulation as part of HTTP Response can lead to crlf injection. This vulnerability is handled as CVE-2014-2017. The attack can be executed remotely. Additionally, an exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Oxid eShop. This vulnerability affects an unknown code. The manipulation as part of a HTTP Response leads to a crlf injection vulnerability. The CWE definition for the vulnerability is CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, and Community Edition before 4.7.11 and 4.8.x before 4.8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

The bug was discovered 03/20/2014. The weakness was released 01/18/2018 by sToRm as EDB-ID 32375 as confirmed exploit (Exploit-DB). The advisory is available at exploit-db.com. This vulnerability was named CVE-2014-2017 since 02/17/2014. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available.

A public exploit has been developed by /sToRm and been published before and not just after the advisory. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1400 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 4.7.11 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (32375) and OSVDB (104351†). Entry connected to this vulnerability is available at VDB-66781. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Oxid

Name

• eShop

Version

• 2.7.0.3
• 3.0.4.1
• 4.0.0.0 13895
• 4.0.0.0 13934
• 4.0.0.0 14260
• 4.0.0.1 14455
• 4.0.0.2 14842
• 4.0.0.2 14967
• 4.0.1.0 15990
• 4.1.0-17976
• 4.1.1-18442
• 4.1.2-18998
• 4.1.3-19918
• 4.5.0
• 4.6.0
• 4.6.1
• 4.6.2
• 4.6.3
• 4.6.4
• 4.6.5
• 4.6.6
• 4.6.7
• 4.6.8
• 4.7.0
• 4.7.1
• 4.7.2
• 4.7.3
• 4.7.4
• 4.7.5
• 4.7.6
• 4.7.7
• 4.7.8
• 4.7.9
• 4.7.10

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion