CVE-2016-4975
published 2018-08-14CVE-2016-4975: Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32…
PriorityP348medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
19.80%
97.1th percentile
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/~user/%0D%0ASet-Cookie:crlfinjection
other(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)
- →Probe mod_userdir endpoints by injecting %0D%0A (CRLF) into the username portion of the URL path (e.g. /~user/%0D%0ASet-Cookie:...) and inspect response headers for injected values such as a spurious Set-Cookie header.
- →Match HTTP response headers for an injected Set-Cookie value using the regex pattern targeting 'crlfinjection=crlfinjection' to confirm successful CRLF injection via mod_userdir.
- →Focus detection on Apache HTTP Server versions 2.4.1–2.4.23 and 2.2.0–2.2.31 running mod_userdir, as these are the confirmed affected ranges. Versions 2.4.25+ and 2.2.32+ are patched. ↗
- →The vulnerability is exploitable via CR or LF injection into the 'Location' or other outbound header key or value through mod_userdir URL paths; monitor for %0D or %0A in /~user/ URL segments in access logs. ↗
- →Use Shodan queries for exposed Apache HTTP Server instances to identify potentially vulnerable targets for prioritized patching or scanning.
- ·The Nuclei template targets a single GET request to /~user/%0D%0ASet-Cookie:crlfinjection and matches only on response headers; it will only fire if mod_userdir is enabled and the server reflects the injected header — false negatives are possible if the server strips or encodes CRLF before the header stage.
- ·Red Hat Enterprise Linux 5, 6, JBoss Enterprise Web Server 2 and 3 are marked 'Will not fix' or 'Out of support scope', meaning vulnerable httpd versions may remain deployed in those environments indefinitely. ↗
- ·The upstream SVN patch (revision 1777405) also contains commits for non-security issues, so applying only that revision may introduce unintended changes; prefer upgrading to the full 2.4.25 or 2.2.32 release. ↗
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1LOW
vendor_redhat6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
vendor_redhat·2018-08-14·CVSS 6.1
CVE-2016-4975 [MEDIUM] CWE-113 httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
It was found that Apache was vulnerable to a HTTP response splitting attack for sites which use mod_userdir. An attacker could use this flaw to inject CRLF characters into the HTTP header and could possibly gain access to secure data.
Package: httpd (Red Hat Enterprise Linux 5) - Will not fix
Package: httpd (Red Hat Enterprise
Debian
CVE-2016-4975: apache2 - Possible CRLF injection allowing HTTP response splitting attacks for sites which...
vendor_debian·2016·CVSS 6.1
CVE-2016-4975 [MEDIUM] CVE-2016-4975: apache2 - Possible CRLF injection allowing HTTP response splitting attacks for sites which...
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
Scope: local
bookworm: resolved (fixed in 2.4.25-1)
bullseye: resolved (fixed in 2.4.25-1)
forky: resolved (fixed in 2.4.25-1)
sid: resolved (fixed in 2.4.25-1)
trixie: resolved (fixed in 2.4.25-1)
GHSA
GHSA-crcg-r773-w4rv: Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
ghsa_unreviewed·2022-05-13
CVE-2016-4975 [MEDIUM] CWE-93 GHSA-crcg-r773-w4rv: Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
OSV
CVE-2016-4975: Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
osv·2018-08-14·CVSS 6.1
CVE-2016-4975 [MEDIUM] CVE-2016-4975: Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
No detection rules found.
Nuclei
Apache mod_userdir CRLF injection
nuclei·CVSS 6.1
CVE-2016-4975 [MEDIUM] Apache mod_userdir CRLF injection
Apache mod_userdir CRLF injection
Apache CRLF injection allowing HTTP response splitting attacks on sites using mod_userdir.
Template:
id: CVE-2016-4975
info:
name: Apache mod_userdir CRLF injection
author: melbadry9,nadino,xElkomy
severity: medium
description: Apache CRLF injection allowing HTTP response splitting attacks on sites using mod_userdir.
impact: |
Successful exploitation of this vulnerability can lead to various attacks such as session hijacking, cross-site scripting (XSS), and cache poisoning.
remediation: Upgrade to Apache HTTP Server 2.2.32/2.4.25 or higher.
reference:
- https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a
HackerOne
mod_userdir CRLF injection (CVE-2016-4975)
hackerone·2018-10-02·CVSS 6.1
CVE-2016-4975 [MEDIUM] mod_userdir CRLF injection (CVE-2016-4975)
mod_userdir CRLF injection (CVE-2016-4975)
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value.
Reported to security team 24th July 2016
Issue public 14th August 2018
Update Released 20th December 2016
Affects 2.4.23, 2.4.20, 2.4.18, 2.4.17, 2.4.16, 2.4.12, 2.4.10, 2.4.9, 2.4.7, 2.4.6, 2.4.4, 2.4.3, 2.4.2, 2.4.1
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975
https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975
## Impact
CRLF Injection
Bugzilla
CVE-2016-4975 httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
bugzilla·2016-09-14·CVSS 6.1
CVE-2016-4975 [MEDIUM] CVE-2016-4975 httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
CVE-2016-4975 httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir
Apache httpd before versions 2.2.32 and 2.4.25 are vulnerable to possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value.
Discussion:
External References:
https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975
---
The recent release of Red Hat JBoss Core Services Apache HTTP Server 2.4.29 contained the fix for CVE-2016-4975.
---
Upstream patch:
https://svn.apache.org/viewvc?view=revision&revisi
http://www.securityfocus.com/bid/105093https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20180926-0006/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_ushttp://www.securityfocus.com/bid/105093https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20180926-0006/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us
2018-08-14
Published