cpp-httplib CRLF Injection Vulnerability Leading to HTTP Response Splitting

A CRLF injection vulnerability has been identified in cpp-httplib versions 0.17.3 through 0.18.3. The issue arises because the library fails to properly filter CRLF characters when they are preceded by a null byte. This flaw allows attackers to inject CRLF sequences into HTTP headers, potentially leading to HTTP response splitting, cross-site scripting (XSS) attacks, and other exploits.

Impact

Exploitation of this vulnerability allows for HTTP response splitting, where an attacker can manipulate the HTTP response sent to the client. This could be used to inject malicious content or headers, such as setting cookies or altering cache behavior. The vulnerability also opens the door to cross-site scripting (XSS) attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, set up an HTTP server using cpp-httplib. Create a route that reads a value from the query string and assigns it to an HTTP header. Then, send a request to the server with a query string parameter that includes a null byte followed by CRLF characters and the injected body content. The injected content should appear in the response body, demonstrating that the CRLF injection was successful.

Remediation

Users can upgrade to cpp-httplib version 0.18.4 or later, where this vulnerability has been fixed. The patch includes validation of header fields against a list of allowed characters, preventing the injection of CRLF sequences.