CVE-2017-14037 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Severity

43%

Complexity

86%

Confidentiality

48%

CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.

CVSS 3.0 Base Score 6.1. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N).

Demo Examples

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-93

If user input data that eventually makes it to a log message isn't checked for CRLF characters, it may be possible for an attacker to forge entries in a log file.


               logger.info("User's street address: " + request.getParameter("streetAddress"));

Overview

Type

CrushFTP

First reported 7 years ago

2017-08-30 21:29:00

Last updated 7 years ago

2017-09-02 11:49:00

Affected Software

CrushFTP 8.0.2

8.0.2

CrushFTP 8.0.3

8.0.3

CrushFTP 8.0.4

8.0.4

CrushFTP 8.1.0

8.1.0

References

https://crushftp.com/version7.html

Vendor Advisory

https://crushftp.com/version8.html