CVE-2022-3215 — HTTP Request/Response Splitting in Apple Swiftnio

CWE-113 — HTTP Request/Response SplittingCWE-74 — Injection4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 52.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple SwiftnioGithub.com Apple Swift-nioSwift Project Swiftnio
Timeline
PublishedSep 28
Latest updateJun 7

Description

NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some form. A malicious user can add newlines to their input (usually in encoded form) and "inject" those newlines into the returned HTTP response. This capability allows users to work around security headers and HTTP/1.1 framing headers by injecti…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapple/swiftnio2.30.0 — 2.39.1+2
▶SwiftURLgithub.com/apple_swift-nio2.41.0 — 2.42.0+2
▶CVEListV5swift_project/swiftniounspecified — 2.41.2

🔴Vulnerability Details

3
OSV
SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')↗2023-06-07
▶
GHSA
SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')↗2023-06-07
▶
CVEList
CVE-2022-3215: NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack↗2022-09-28
▶
CVE-2022-3215 — HTTP Request/Response Splitting | cvebase