Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

refit

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 10.0NuGetPublished

    CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

    CVE-2024-51501 · GHSA-3hxg-fxwm-8gf7

    Affected
    • NuGet refit < 7.2.22
    Fixed in
    7.2.22· Vendor fix available
    Issue
    The various header-related Refit attributes (Header, HeaderCollection and Authorize) are vulnerable to CRLF injection. Details The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: <https://github.com/reactiveui/refit/blob/258a771f44417c6e48e103ac921fe4786f3c2a1e/Refit/RequestBuilderImplementation.cs#L1328 This method does not check for CRLF characters in the header value. This means that any headers added to a refit request are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests. PoC The below example code creates a console app that takes one command line variable (a bearer token) and then makes a request to some status page with the provided token inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting…

    Recommended action: Upgrade to 7.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →