Crlf-Injection — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/crlf-injection/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 16 Apr 2026 03:17:58 +0000Openfind MailGates/MailAudit CRLF Injection Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-04-mailgates-crlf/Thu, 16 Apr 2026 03:17:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-04-mailgates-crlf/Openfind MailGates/MailAudit is vulnerable to CRLF injection (CVE-2026-6351), enabling unauthenticated remote attackers to read system files by injecting malicious CRLF sequences.Openfind MailGates and MailAudit are susceptible to a CRLF injection vulnerability identified as CVE-2026-6351. This flaw allows unauthenticated remote attackers to inject carriage return and line feed characters into HTTP headers. By manipulating these headers, attackers can potentially read system files due to the application’s failure to properly neutralize CRLF sequences. This can lead to information disclosure and potentially further compromise of the affected system. The vulnerability was reported on April 15, 2026, and has a CVSS v3.1 score of 7.5, indicating a high severity. This poses a significant risk to organizations using affected versions of MailGates/MailAudit.

Attack Chain

  1. An unauthenticated attacker identifies a MailGates/MailAudit instance exposed to the internet.
  2. The attacker crafts a malicious HTTP request containing CRLF sequences within a vulnerable parameter (e.g., URL or header value).
  3. The CRLF sequences are injected into an HTTP header, allowing the attacker to insert additional headers or manipulate existing ones.
  4. By injecting a Content-Type header followed by a blank line and arbitrary content, the attacker attempts to inject data into the HTTP response body.
  5. The server processes the crafted request without properly sanitizing the CRLF sequences.
  6. The injected content, which could include commands to read system files, is interpreted by the server.
  7. The server responds with the content of the requested system file within the HTTP response.
  8. The attacker retrieves the sensitive information from the server’s response, achieving unauthorized access to system files.

Impact

Successful exploitation of this CRLF injection vulnerability (CVE-2026-6351) can lead to unauthorized access to sensitive system files on the affected MailGates/MailAudit server. This can result in the disclosure of confidential information, such as usernames, passwords, configuration details, and other sensitive data. The number of potential victims is dependent on the number of organizations using vulnerable versions of Openfind MailGates/MailAudit. The affected sectors are likely those that rely on these applications for email security and auditing. The consequences of a successful attack include data breaches, potential regulatory fines, and reputational damage.

Recommendation

  • Apply the patches or updates provided by Openfind to address CVE-2026-6351 as soon as they become available.
  • Implement input validation and sanitization on all user-supplied data to prevent CRLF injection attacks (reference CWE-93).
  • Deploy the Sigma rule Detect Suspicious CRLF Injection Attempts to identify potential exploitation attempts targeting this vulnerability.
  • Monitor web server logs for unusual patterns or unexpected characters in HTTP headers, specifically looking for CRLF sequences (\r\n) to detect potential exploitation attempts. Enable webserver logging to activate the rule above.
]]>highadvisorycrlf-injectionvulnerabilitymailgatesmailauditi18next-http-middleware HTTP Response Splitting and DoS Vulnerabilityhttps://feed.craftedsignal.io/briefs/2024-01-i18next-http-middleware-crlf/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-i18next-http-middleware-crlf/i18next-http-middleware versions before 3.9.3 are vulnerable to HTTP response splitting and denial-of-service attacks due to unsanitized Content-Language headers, potentially leading to session fixation, cache poisoning, reflected XSS, or complete service disruption depending on the Node.js version.The i18next-http-middleware library, in versions prior to 3.9.3, exhibits a vulnerability stemming from insufficient sanitization of user-controlled language values. These values are written into the Content-Language HTTP response header. The utils.escape() function, employed for sanitization, performs HTML-entity encoding but fails to strip critical characters like carriage return and line feed. When the application uses an older i18next (< 19.5.0) or produces raw detected values, CRLF sequences within the lng parameter reach res.setHeader('Content-Language', ...) without proper escaping. This flaw can result in HTTP response splitting (Node.js < 14.6.0) or a denial-of-service condition (Node.js >= 14.6.0), impacting all concurrent users of the affected process. The same vulnerability is triggered multiple times per request. This issue is resolved in version 3.9.3.

Attack Chain

  1. The attacker crafts a malicious HTTP request targeting an application using a vulnerable version of i18next-http-middleware. The request includes a lng parameter with a payload containing CRLF sequences (e.g., %0d%0a).
  2. The i18next-http-middleware receives the request and extracts the language value from the lng parameter.
  3. The extracted language value is passed through utils.escape(), which performs HTML-entity encoding but does not remove CRLF sequences.
  4. The middleware attempts to set the Content-Language header using res.setHeader(), incorporating the unsanitized language value.
  5. If the Node.js version is less than 14.6.0, the res.setHeader() function processes the CRLF sequences, resulting in HTTP response splitting. This allows the attacker to inject arbitrary headers and control parts of the response body.
  6. If the Node.js version is 14.6.0 or greater, res.setHeader() throws an ERR_INVALID_CHAR error because the value contains CRLF sequences.
  7. The middleware fails to catch this error, and the exception propagates, leading to an unhandled exception.
  8. The unhandled exception causes the Node.js process to terminate or become unresponsive, resulting in a denial-of-service condition for all concurrent users sharing that process.

Impact

Successful exploitation allows attackers to inject arbitrary HTTP headers, leading to session fixation, cache poisoning, or reflected XSS attacks. In Node.js versions 14.6.0 and later, exploitation leads to a denial-of-service condition, potentially impacting all users of an application instance. This can result in significant disruption of service availability and potential data compromise. The number of affected applications is unknown, but any application using a vulnerable version of i18next-http-middleware is at risk.

Recommendation

  • Upgrade i18next-http-middleware to version 3.9.3 or later to address the vulnerability by patching the utils.sanitizeHeaderValue() function, as described in the advisory.
  • Deploy the Sigma rule Detect i18next-http-middleware CRLF Injection Attempt to monitor for exploitation attempts by detecting suspicious URL-encoded characters in HTTP requests.
  • Implement a Web Application Firewall (WAF) rule to reject requests containing \r or \n characters in query parameters, cookies, and path segments as a partial mitigation, as suggested in the advisory.
  • Enable web server logging to ensure events related to potential exploits are captured for analysis.
]]>mediumadvisorycrlf-injectionhttp-response-splittingdenial-of-servicei18next