CVE-2016-4993: CRLF Injection
CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Other sources
It was reported that WildFly 10.0.0 Application Server/Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also Response Splitting, due to insufficient sanitisation and validation of user input before the input is used as part of a HTTP header value.
Using newline characters injected into the HTTP headers, it is possible for the malicious user to add arbitrary headers such as Set-Cookie to set arbitrary cookies, or potentially use a Location header for an open-redirect. By using two newline characters the attacker can 'split' the response (HTTP Response Splitting) and provide their own content that will be rendered to the victim user.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4993?
CVE-2016-4993 has a medium severity rating as it allows for HTTP response splitting attacks.
How do I fix CVE-2016-4993?
To fix CVE-2016-4993, upgrade to WildFly 10.0.1 or higher or JBoss EAP 7.0.2 or higher.
Which versions are affected by CVE-2016-4993?
CVE-2016-4993 affects WildFly 10.0.0 and JBoss EAP 7.x versions prior to 7.0.2.
What types of attacks can CVE-2016-4993 allow?
CVE-2016-4993 can allow attackers to conduct arbitrary HTTP header injection and HTTP response splitting attacks.
Who is vulnerable to CVE-2016-4993?
Organizations using WildFly 10.0.0 or JBoss EAP 7.x versions up to 7.0.1 are vulnerable to CVE-2016-4993.