CVE-2013-1869: Input Validation
CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via the returnurl parameter.
Other sources
Ryan Giobbi from UPMC reported a header injection flaw in the Spacewalk web UI's return URL parameter:
Request
GET /rhn/systems/Overview.do?emptyset=true&returnurl=67172%0d%0ad42e002fa0f HTTP/1.1 Host: host.example.com Accept: / Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: https://host.example.com/rhn/YourRhn.do Cookie: pxt-session-cookie=7053xcace9e6d1158735e6f047ab49e4e509c; JSESSIONID=FAEED8F0E45715879B0D0AFACB8ADFF7
Response
HTTP/1.0 302 Moved Temporarily Date: Thu, 21 Feb 2013 17:43:48 GMT Location: https://host.example.com/rhn/systems/67172 d42e002fa0f Content-Type: text/html;charset=UTF-8 Content-Length: 0 Set-Cookie: pxt-session-cookie=7053xcace9e6d1158735e6f047ab49e4e509c; Path=/; Secure; HttpOnly Connection: close
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1869?
CVE-2013-1869 is classified as a critical severity vulnerability due to its potential for arbitrary HTTP header injection and other exploitations.
How do I fix CVE-2013-1869?
To fix CVE-2013-1869, update the affected software to spacewalk-java version 2.1.148-1 or later, or upgrade RHN Satellite to version 5.6.1 or later.
Which software versions are affected by CVE-2013-1869?
CVE-2013-1869 affects spacewalk-java versions up to 2.1.147-1 and RHN Satellite version 5.6.
Can CVE-2013-1869 lead to XSS attacks?
Yes, CVE-2013-1869 can lead to cross-site scripting (XSS) attacks due to HTTP response splitting.
Who reported the CVE-2013-1869 vulnerability?
The CVE-2013-1869 vulnerability was reported by Ryan Giobbi from UPMC.