CVE-2021-41084
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Summary
http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (Header.nameå), Header values (Header.value), Status reason phrases (Status.reason), URI paths (Uri.Path), URI authority registered names (URI.RegName) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| http4s | http4s | <= 0.21.28 | affected |
| http4s | http4s | >= 0.22.0, < 0.22.5 | affected |
| http4s | http4s | >= 0.23.0, < 0.23.4 | affected |
| http4s | http4s | >= 1.0.0-M1, < 1.0.0-M27 | affected |
Weaknesses
- CWE-918: CWE-918: Server-Side Request Forgery (SSRF)
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3
- https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8
- https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values
- https://owasp.org/www-community/attacks/HTTP_Response_Splitting
References
- https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3
- https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8
- https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values
- https://owasp.org/www-community/attacks/HTTP_Response_Splitting
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.