CVE-2023-0040 (GCVE-0-2023-0040)

Vulnerability from cvelistv5 – Published: 2023-01-18 00:00 – Updated: 2025-04-03 19:28
VLAI?
Summary
Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
Impacted products
Vendor Product Version
Swift Project Async HTTP Client Affected: unspecified , ≤ 1.13.1 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:32.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0040",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T17:47:16.776743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T19:28:55.800Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Async HTTP Client",
          "vendor": "Swift Project",
          "versions": [
            {
              "lessThanOrEqual": "1.13.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-18T00:00:00.000Z",
        "orgId": "e4a1ddda-f4f5-496e-96c8-82c37d06abd0",
        "shortName": "Swift"
      },
      "references": [
        {
          "url": "https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4a1ddda-f4f5-496e-96c8-82c37d06abd0",
    "assignerShortName": "Swift",
    "cveId": "CVE-2023-0040",
    "datePublished": "2023-01-18T00:00:00.000Z",
    "dateReserved": "2023-01-03T00:00:00.000Z",
    "dateUpdated": "2025-04-03T19:28:55.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.4.1\", \"matchCriteriaId\": \"968BBD5B-F40A-4330-8A08-BA0369081C9F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.5.0\", \"versionEndExcluding\": \"1.9.1\", \"matchCriteriaId\": \"95624139-0F15-4284-BA07-EB80A3D71561\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.10.0\", \"versionEndExcluding\": \"1.12.1\", \"matchCriteriaId\": \"0ABE1F7C-D2C4-47B9-ABB5-46EA62D101C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.13.0\", \"versionEndExcluding\": \"1.13.2\", \"matchCriteriaId\": \"E91AB921-277B-47A5-999E-BD65CBAC0239\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.\"}, {\"lang\": \"es\", \"value\": \"Las versiones de Async HTTP Client anteriores a la 1.13.2 son vulnerables a una forma de manipulaci\\u00f3n de solicitudes dirigida llamada inyecci\\u00f3n CRLF. Esta vulnerabilidad fue el resultado de una validaci\\u00f3n insuficiente de los valores de los campos del encabezado HTTP antes de enviarlos a la red. Los usuarios son vulnerables si pasan datos que no son de confianza a valores de campos de encabezado HTTP sin una desinfecci\\u00f3n previa. Los casos de uso comunes aqu\\u00ed podr\\u00edan ser colocar nombres de usuario de una base de datos en campos de encabezado HTTP. Esta vulnerabilidad permite a los atacantes inyectar nuevos campos de encabezado HTTP o solicitudes completamente nuevas en el flujo de datos. Esto puede hacer que el servidor remoto comprenda las solicitudes de forma muy diferente a la prevista. En general, es poco probable que esto d\\u00e9 lugar a la divulgaci\\u00f3n de datos, pero puede dar lugar a una serie de errores l\\u00f3gicos y otras malas conductas.\"}]",
      "id": "CVE-2023-0040",
      "lastModified": "2024-11-21T07:36:26.600",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2023-01-18T19:15:11.163",
      "references": "[{\"url\": \"https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq\", \"source\": \"cve@forums.swift.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@forums.swift.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cve@forums.swift.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-93\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-74\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-0040\",\"sourceIdentifier\":\"cve@forums.swift.org\",\"published\":\"2023-01-18T19:15:11.163\",\"lastModified\":\"2025-04-03T20:15:19.573\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.\"},{\"lang\":\"es\",\"value\":\"Las versiones de Async HTTP Client anteriores a la 1.13.2 son vulnerables a una forma de manipulaci\u00f3n de solicitudes dirigida llamada inyecci\u00f3n CRLF. Esta vulnerabilidad fue el resultado de una validaci\u00f3n insuficiente de los valores de los campos del encabezado HTTP antes de enviarlos a la red. Los usuarios son vulnerables si pasan datos que no son de confianza a valores de campos de encabezado HTTP sin una desinfecci\u00f3n previa. Los casos de uso comunes aqu\u00ed podr\u00edan ser colocar nombres de usuario de una base de datos en campos de encabezado HTTP. Esta vulnerabilidad permite a los atacantes inyectar nuevos campos de encabezado HTTP o solicitudes completamente nuevas en el flujo de datos. Esto puede hacer que el servidor remoto comprenda las solicitudes de forma muy diferente a la prevista. En general, es poco probable que esto d\u00e9 lugar a la divulgaci\u00f3n de datos, pero puede dar lugar a una serie de errores l\u00f3gicos y otras malas conductas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"cve@forums.swift.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-93\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.4.1\",\"matchCriteriaId\":\"968BBD5B-F40A-4330-8A08-BA0369081C9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.5.0\",\"versionEndExcluding\":\"1.9.1\",\"matchCriteriaId\":\"95624139-0F15-4284-BA07-EB80A3D71561\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.10.0\",\"versionEndExcluding\":\"1.12.1\",\"matchCriteriaId\":\"0ABE1F7C-D2C4-47B9-ABB5-46EA62D101C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:asynchttpclient_project:async-http-client:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.13.0\",\"versionEndExcluding\":\"1.13.2\",\"matchCriteriaId\":\"E91AB921-277B-47A5-999E-BD65CBAC0239\"}]}]}],\"references\":[{\"url\":\"https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq\",\"source\":\"cve@forums.swift.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:54:32.569Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-0040\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-02T17:47:16.776743Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-74\", \"description\": \"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-02T17:47:52.464Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Swift Project\", \"product\": \"Async HTTP Client\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.13.1\"}]}], \"references\": [{\"url\": \"https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-93\", \"description\": \"CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"e4a1ddda-f4f5-496e-96c8-82c37d06abd0\", \"shortName\": \"Swift\", \"dateUpdated\": \"2023-01-18T00:00:00.000Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-0040\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-03T19:28:55.800Z\", \"dateReserved\": \"2023-01-03T00:00:00.000Z\", \"assignerOrgId\": \"e4a1ddda-f4f5-496e-96c8-82c37d06abd0\", \"datePublished\": \"2023-01-18T00:00:00.000Z\", \"assignerShortName\": \"Swift\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.