Carriage Return Line Feed(CRLF) Injection

Refit is vulnerable to Carriage Return Line FeedCRLF Injection. The vulnerability is due to lack of validation for CRLF characters in HTTP header values in the Refit library. Specifically, the HttpHeaders.TryAddWithoutValidation method used by Refit does not sanitize or check for CRLF sequences,...

CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

Summary The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. Details The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: This method does not check for CRLF characters in the header valu...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection due to header-related attributes: Header, HeaderCollection and Authorize, through the HttpHeaders.TryAddWithoutValidation method. An attacker can manipulate HTTP headers or perform HTTP request smuggling. Notes: 1 This is...

GHSA-3HXG-FXWM-8GF7 CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

Summary The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. Details The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: This method does not check for CRLF characters in the header valu...

CVE-2024-51501

Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method. This...

CVE-2024-51501

Refit (a .NET REST client) is vulnerable to CRLF injection via its header-related attributes (Header, HeaderCollection, Authorize). The underlying issue is lack of validation in HttpHeaders.TryAddWithoutValidation, which allows CRLF characters in header values, enabling header injection, request ...

CVE-2024-51501 CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method. This...

CVE-2024-51501

Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the "HttpHeaders.TryAddWithoutValidation" method. Th...

CVE-2024-51501 CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method. This...

CVE-2024-51501 CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method. This...

PT-2024-34666 · .Net · Refit

Name of the Vulnerable Software and Affected Versions: Refit versions prior to 7.2.22 Refit versions prior to 8.0.0 Description: The Refit library for .NET Core, Xamarin, and .NET has a CRLF injection vulnerability in its header-related attributes. This vulnerability occurs because the...

CVE-2024-51501: Improper Neutralization of CRLF Sequences

Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method. This...

Refit 注入漏洞

Refit is a library in the ReactiveUI open source. Refit suffers from an injection vulnerability that stems from failing to check for CRLF characters in the header value, making it vulnerable to server-side request forgery attacks...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2023-49082 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2023-49082 Source advisory: OSV:GHSA-QVRW-V9RV-5RJX...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2023-47641 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2023-47641 Source advisory: OSV:PYSEC-2023-247...

netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2023-46446 via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2023-46446 Source advisory: OSV:PYSEC-2023-239...

netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2023-46445 via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2023-46445 Source advisory: OSV:PYSEC-2023-237...

netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2023-46445 via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2023-46445 Source advisory: OSV:GHSA-CFC2-WR2V-GXM5...

com.googlecode.refit.jenkins:refit (>=0.1, <=0.3.1), jenkins.plugins.clangscanbuild:clang-scanbuild-plugin (>=1.0, <=1.3.1) +19 more potentially affected by CVE-2021-21615 via org.jenkins-ci.main:jenkins-core (1.403)

org.jenkins-ci.main:jenkins-core MAVEN version 1.403 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.googlecode.refit.jenkins:refit =0.1, =1.0, =1.19, =1.3, =2.1, =0.2.4, =0.2.8 -...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2021-21330 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2021-21330 Source advisory: OSV:GHSA-V6WP-4M6F-GCJG...