Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affecting islandora/crayfish package, versions >=0.0.0
Threat Intelligence
Exploit maturity not defined.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-ISLANDORACRAYFISH-8720399
- published13 Feb 2025
- disclosed12 Feb 2025
- creditXBOW Security
Introduced: 12 Feb 2025
New CVE NOT AVAILABLE CWE-74 (opens in a new tab)How to fix?
There is no fixed version for islandora/crayfish.
Overview
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the X-Islandora-Args header. An attacker can execute arbitrary code on the server by sending a crafted request containing malicious input in this header.
Note:
This is only exploitable if the microservice is directly accessible from the Internet.
Workaround
This vulnerability can be mitigated by preventing general access from the Internet from hitting Hypercube and ensuring that the microservice is behind a firewall. Additionally, validating the structure of headers passed to the webserver can further reduce the risk if the endpoint is publicly exposed.