Apache Thrift Origin Validation Error and Path Traversal Vulnerability

A vulnerability in Apache Thrift prior to version 0.23.0 allows for origin validation errors, improper limitation of pathnames leading to path traversal, improper neutralization of CRLF sequences in HTTP headers causing HTTP request/response splitting, and uncontrolled resource consumption.

Impact

Exploitation of this vulnerability could lead to path traversal, allowing attackers to access restricted directories, and HTTP request/response splitting, which could be used to manipulate HTTP responses or requests.

Remediation

Users are advised to upgrade to Apache Thrift version 0.23.0 or later, which addresses this vulnerability.