GHSA-2qh5-382h-3jpc: CRLF Injection
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds You can strip CRLF bytes from email header values before setting header values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.2.14 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.1.9 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.6.5 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.5.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.3.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.2.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.1.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.5.12 - Configuration
Before calling Message::setHeaders() or addHeaders(), remove/strip any CRLF bytes from the email header value(s) (including those built from user-controlled data) to prevent CRLF-based header injection.
Email headers set via Message::setHeaders()/addHeaders() Strip CRLF bytes from header values = Strip CRLF (carriage return \r and newline \n) from any user-controlled data before setting header values
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An application must pass user-controlled data into custom mail headers through Message::setHeaders() or addHeaders() without first removing CRLF bytes. The issue is limited to those custom header values.
Which releases contain a fix?
Fixed releases are 5.3.7, 5.2.14, 5.1.9, 4.6.5, and 4.5.12.
What can be done if updating is not immediately possible?
Strip CRLF bytes from all email header values before setting them. Apply this validation wherever values are passed to Message::setHeaders() or addHeaders().