CRLF Injection Affecting refit package, versions [,8.0.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-REFIT-8344796
- published 7 Nov 2024
- disclosed 4 Nov 2024
- credit sofiaml
Introduced: 4 Nov 2024
New CVE-2024-51501 Open this link in a new tabHow to fix?
Upgrade Refit to version 8.0.0 or higher.
Overview
Affected versions of this package are vulnerable to CRLF Injection due to header-related attributes: Header, HeaderCollection and Authorize, through the HttpHeaders.TryAddWithoutValidation method. An attacker can manipulate HTTP headers or perform HTTP request smuggling.
Notes:
This is not necessarily a security issue for a command line application, but if such code were present in a web application then it becomes vulnerable to request splitting.
This is a potential vulnerability in applications using Refit, not in Refit itself.