GHSA-GV3V-92V6-M48J严重已审查

Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)

OSV 1.4.0 · github-reviewed · 修改于 2021-07-29 23:47

发布时间

2020-04-03 23:23

GitHub 审查时间

2020-04-03 07:59

NVD 发布时间

2020-04-06 23:15

源文件

advisories/github-reviewed/2020/04/GHSA-gv3v-92v6-m48j/GHSA-gv3v-92v6-m48j.json

公告说明

Impact

Cross Site Scripting
Cache Poisoning
Page Hijacking

Patches

This was fixed in version 2.2.1.

Workarounds

If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters.

References

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

I've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability.

Root Cause

This roots cause back to this line in the Jooby codebase:

https://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102

The DefaultHttpHeaders takes a parameter validate which, when true (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting.

Reported By

This vulnerability was reported by @JLLeitschuh (Twitter)

For more information

If you have any questions or comments about this advisory:

Open an issue in jooby-project/jooby

受影响的软件包

标识信息

别名 / CVE

CVE-2020-7622

CWE

CWE-444

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-gv3v-92v6-m48j",
  "aliases": [
    "CVE-2020-7622"
  ],
  "details": "### Impact\n\n - Cross Site Scripting\n - Cache Poisoning\n - Page Hijacking\n\n### Patches\n\nThis was fixed in version `2.2.1`.\n\n### Workarounds\n\nIf you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters.\n\n### References\n\n##### [CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)\n\nI've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability.\n\n### Root Cause\n\nThis roots cause back to this line in the Jooby codebase:\n\nhttps://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102\n\nThe `DefaultHttpHeaders` takes a parameter `validate` which, when `true` (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting.\n\n### Reported By\n\nThis vulnerability was reported by @JLLeitschuh ([Twitter](https://twitter.com/JLLeitschuh))\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [jooby-project/jooby](https://github.com/jooby-project/jooby/issues)",
  "summary": "Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.1"
            }
          ]
        }
      ],
      "package": {
        "name": "io.jooby:jooby-netty",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2021-07-29T15:47:43Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2020-04-03T15:23:30Z",
  "references": [
    {
      "url": "https://github.com/jooby-project/jooby/security/advisories/GHSA-gv3v-92v6-m48j",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7622",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/jooby-project/jooby/commit/b66e3342cf95205324023cfdf2cb5811e8a6dcf4",
      "type": "WEB"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2020-04-06T15:15:00Z",
    "github_reviewed_at": "2020-04-02T23:59:56Z"
  }
}