CVE-2023-26142

Summary

CVE-2023-26142 is a newly disclosed vulnerability affecting all versions of the crow package. This issue allows for HTTP Response Splitting when untrusted user input is used to construct header values. The set_header and add_header functions in the crow package do not adequately sanitize these values against CRLF Injection. As a result, an attacker can inject malicious content by adding carriage return line feeds (\\r\\n) to end the HTTP response headers. This vulnerability poses a significant risk, as it can lead to severe consequences, including data leaks, unauthorized access, and redirects to malicious websites. It is crucial for users of the crow package to apply the necessary patches as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.