{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/http-response-splitting/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["i18next-http-middleware"],"_cs_severities":["medium"],"_cs_tags":["crlf-injection","http-response-splitting","denial-of-service","i18next"],"_cs_type":"advisory","_cs_vendors":["npm"],"content_html":"\u003cp\u003eThe \u003ccode\u003ei18next-http-middleware\u003c/code\u003e library, in versions prior to 3.9.3, exhibits a vulnerability stemming from insufficient sanitization of user-controlled language values. These values are written into the \u003ccode\u003eContent-Language\u003c/code\u003e HTTP response header. The \u003ccode\u003eutils.escape()\u003c/code\u003e function, employed for sanitization, performs HTML-entity encoding but fails to strip critical characters like carriage return and line feed. When the application uses an older \u003ccode\u003ei18next\u003c/code\u003e (\u0026lt; 19.5.0) or produces raw detected values, CRLF sequences within the \u003ccode\u003elng\u003c/code\u003e parameter reach \u003ccode\u003eres.setHeader('Content-Language', ...)\u003c/code\u003e without proper escaping. This flaw can result in HTTP response splitting (Node.js \u0026lt; 14.6.0) or a denial-of-service condition (Node.js \u0026gt;= 14.6.0), impacting all concurrent users of the affected process.  The same vulnerability is triggered multiple times per request. This issue is resolved in version 3.9.3.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request targeting an application using a vulnerable version of \u003ccode\u003ei18next-http-middleware\u003c/code\u003e. The request includes a \u003ccode\u003elng\u003c/code\u003e parameter with a payload containing CRLF sequences (e.g., \u003ccode\u003e%0d%0a\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ei18next-http-middleware\u003c/code\u003e receives the request and extracts the language value from the \u003ccode\u003elng\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe extracted language value is passed through \u003ccode\u003eutils.escape()\u003c/code\u003e, which performs HTML-entity encoding but does not remove CRLF sequences.\u003c/li\u003e\n\u003cli\u003eThe middleware attempts to set the \u003ccode\u003eContent-Language\u003c/code\u003e header using \u003ccode\u003eres.setHeader()\u003c/code\u003e, incorporating the unsanitized language value.\u003c/li\u003e\n\u003cli\u003eIf the Node.js version is less than 14.6.0, the \u003ccode\u003eres.setHeader()\u003c/code\u003e function processes the CRLF sequences, resulting in HTTP response splitting. This allows the attacker to inject arbitrary headers and control parts of the response body.\u003c/li\u003e\n\u003cli\u003eIf the Node.js version is 14.6.0 or greater, \u003ccode\u003eres.setHeader()\u003c/code\u003e throws an \u003ccode\u003eERR_INVALID_CHAR\u003c/code\u003e error because the value contains CRLF sequences.\u003c/li\u003e\n\u003cli\u003eThe middleware fails to catch this error, and the exception propagates, leading to an unhandled exception.\u003c/li\u003e\n\u003cli\u003eThe unhandled exception causes the Node.js process to terminate or become unresponsive, resulting in a denial-of-service condition for all concurrent users sharing that process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to inject arbitrary HTTP headers, leading to session fixation, cache poisoning, or reflected XSS attacks. In Node.js versions 14.6.0 and later, exploitation leads to a denial-of-service condition, potentially impacting all users of an application instance. This can result in significant disruption of service availability and potential data compromise. The number of affected applications is unknown, but any application using a vulnerable version of \u003ccode\u003ei18next-http-middleware\u003c/code\u003e is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003ei18next-http-middleware\u003c/code\u003e to version 3.9.3 or later to address the vulnerability by patching the \u003ccode\u003eutils.sanitizeHeaderValue()\u003c/code\u003e function, as described in the advisory.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect i18next-http-middleware CRLF Injection Attempt\u003c/code\u003e to monitor for exploitation attempts by detecting suspicious URL-encoded characters in HTTP requests.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to reject requests containing \u003ccode\u003e\\r\u003c/code\u003e or \u003ccode\u003e\\n\u003c/code\u003e characters in query parameters, cookies, and path segments as a partial mitigation, as suggested in the advisory.\u003c/li\u003e\n\u003cli\u003eEnable web server logging to ensure events related to potential exploits are captured for analysis.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"/briefs/2024-01-i18next-http-middleware-crlf/","summary":"i18next-http-middleware versions before 3.9.3 are vulnerable to HTTP response splitting and denial-of-service attacks due to unsanitized Content-Language headers, potentially leading to session fixation, cache poisoning, reflected XSS, or complete service disruption depending on the Node.js version.","title":"i18next-http-middleware HTTP Response Splitting and DoS Vulnerability","url":"https://feed.craftedsignal.io/briefs/2024-01-i18next-http-middleware-crlf/"}],"language":"en","title":"CraftedSignal Threat Feed — Http-Response-Splitting","version":"https://jsonfeed.org/version/1.1"}