libsoup CRLF Injection Vulnerability in HTTP Request Handling

A CRLF injection vulnerability has been identified in libsoup, specifically within the 'soup_message_new()' function. This issue allows remote attackers to inject arbitrary HTTP headers and request data by manipulating the method parameter. The vulnerability arises because the method value is not properly sanitized before being used to construct the request line, potentially leading to HTTP request injection.

Impact

Exploitation of this vulnerability allows for CRLF injection, which can be used to manipulate HTTP headers and request data. This could lead to header injection attacks or other forms of HTTP request manipulation.

Reproduction

The vulnerability can be reproduced by calling the 'soup_message_new()' function with a user-controlled method parameter that includes CRLF sequences. This will inject the specified headers into the HTTP request. The injection can be verified by checking the headers received by the server.

Remediation

To address this vulnerability, it is recommended to sanitize or reject method values that contain invalid characters, including any whitespace. A patch has been proposed and is under review.