CVE-2020-35669 http before 0.13.3 vulnerable to header injection
Attackers can inject CRLF sequences into HTTP requests via the Dart http package, potentially leading to request smuggling or header injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-35669?
CVE-2020-35669 is a medium-severity vulnerability in n/a, published on 24 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.
Weakness: CWE-74
Which versions are affected by CVE-2020-35669?
2 open source packages ship an affected version, including http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
http Pub | All versions | 0.13.3 |
http Pub | All versions | 0.13.3 |
Products include Dart Http.
How do I fix CVE-2020-35669?
Upgrade http to 0.13.3 or later.
Is CVE-2020-35669 being exploited?
There is no known exploitation of CVE-2020-35669 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-4rgh-jx4f-qfcq.