cpp-httplib CRLF Injection Vulnerability in Header Processing Allowing SSRF

A CRLF injection vulnerability has been identified in cpp-httplib versions prior to 0.30.0. The issue arises in the write_headers function, which fails to sanitize user-supplied header values, allowing the injection of CRLF characters. This oversight enables attackers to add additional headers, unexpectedly modify the request body, and potentially exploit server-side request forgery (SSRF) vulnerabilities, especially when targeting servers that support HTTP/1.1 pipelining, such as those built with Spring Boot or Python's Twisted framework.

Impact

Exploitation of this vulnerability could lead to unauthorized header injection, manipulation of request bodies, and exploitation of SSRF vulnerabilities on the target server.

Reproduction

The vulnerability can be reproduced by sending a crafted HTTP request with headers that include CRLF sequences. This can be done using the cpp-httplib library itself, by creating a client that sends such a request. The injected CRLF can escape the header context, creating new header lines or modifying the request body, depending on how the server processes the request.

Remediation

Users are advised to update to cpp-httplib version 0.30.0 or later, where this vulnerability has been fixed.