Attack Chain

1. The attacker crafts a malicious HTTP request targeting an application using a vulnerable version of i18next-http-middleware. The request includes a lng parameter with a payload containing CRLF sequences (e.g., %0d%0a).
2. The i18next-http-middleware receives the request and extracts the language value from the lng parameter.
3. The extracted language value is passed through utils.escape(), which performs HTML-entity encoding but does not remove CRLF sequences.
4. The middleware attempts to set the Content-Language header using res.setHeader(), incorporating the unsanitized language value.
5. If the Node.js version is less than 14.6.0, the res.setHeader() function processes the CRLF sequences, resulting in HTTP response splitting. This allows the attacker to inject arbitrary headers and control parts of the response body.
6. If the Node.js version is 14.6.0 or greater, res.setHeader() throws an ERR_INVALID_CHAR error because the value contains CRLF sequences.
7. The middleware fails to catch this error, and the exception propagates, leading to an unhandled exception.
8. The unhandled exception causes the Node.js process to terminate or become unresponsive, resulting in a denial-of-service condition for all concurrent users sharing that process.

Impact

Successful exploitation allows attackers to inject arbitrary HTTP headers, leading to session fixation, cache poisoning, or reflected XSS attacks. In Node.js versions 14.6.0 and later, exploitation leads to a denial-of-service condition, potentially impacting all users of an application instance. This can result in significant disruption of service availability and potential data compromise. The number of affected applications is unknown, but any application using a vulnerable version of i18next-http-middleware is at risk.

Recommendation

• Upgrade i18next-http-middleware to version 3.9.3 or later to address the vulnerability by patching the utils.sanitizeHeaderValue() function, as described in the advisory.
• Deploy the Sigma rule Detect i18next-http-middleware CRLF Injection Attempt to monitor for exploitation attempts by detecting suspicious URL-encoded characters in HTTP requests.
• Implement a Web Application Firewall (WAF) rule to reject requests containing \r or \n characters in query parameters, cookies, and path segments as a partial mitigation, as suggested in the advisory.
• Enable web server logging to ensure events related to potential exploits are captured for analysis.