reactiveui refit up to 7.x HttpHeaders.TryAddWithoutValidation Header/HeaderCollection/Authorize crlf injection

Summaryinfo

A vulnerability was found in reactiveui refit up to 7.x. It has been rated as problematic. The impacted element is the function HttpHeaders.TryAddWithoutValidation. Performing a manipulation of the argument Header/HeaderCollection/Authorize results in crlf injection. This vulnerability is cataloged as CVE-2024-51501. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in reactiveui refit up to 7.x. This affects the function HttpHeaders.TryAddWithoutValidation. The manipulation of the argument Header/HeaderCollection/Authorize with an unknown input leads to a crlf injection vulnerability. CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on integrity. The summary by CVE is:

Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes (Header, HeaderCollection and Authorize) are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the `HttpHeaders.TryAddWithoutValidation` method. This method does not check for CRLF characters in the header value. This means that any headers added to a refit request are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests. If an application using the Refit library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using Refit and not in Refit itself. This issue has been addressed in release version 8.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-51501 since 10/28/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 8.0.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• reactiveui

Name

• refit

Version

• 7.x

Website

• Product: https://github.com/reactiveui/refit/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion