Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

restsharp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.7NuGetPublished

    CRLF Injection in RestSharp's RestRequest.AddHeader method

    CVE-2024-45302 · GHSA-4rr6-2v9v-wcpc

    Affected
    • NuGet restsharp >= 107.0.0-preview.1, < 112.0.0
    Fixed in
    112.0.0· Vendor fix available
    Issue
    The second argument to RestRequest.AddHeader (the header value) is vulnerable to CRLF injection. The same applies to RestRequest.AddOrUpdateHeader and RestClient.AddDefaultHeader. Details The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: <https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32 This method does not check for CRLF characters in the header value. This means that any headers from a RestSharp.RequestHeaders object are added to the request in such a way that they are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests. PoC The below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the…

    Recommended action: Upgrade to 112.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5NuGetPublished

    Incorrect Regular Expression in RestSharp

    CVE-2021-27293 · GHSA-9pq7-rcxv-47vq

    Affected
    • NuGet restsharp <= 106.11.7
    Fixed in
    106.11.8-alpha.0.13· Vendor fix available
    Issue
    RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.

    Recommended action: Upgrade to 106.11.8-alpha.0.13 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →