CVE-2021-31402
📋 TL;DR
CVE-2021-31402 is a CRLF injection vulnerability in the Dio HTTP client package for Dart. Attackers who can control the HTTP method string can inject malicious headers or split responses. This affects applications using Dio 4.0.0 for HTTP requests.
💻 Affected Systems
- Dio HTTP client package for Dart
📦 What is this software?
Dio by Flutterchina
⚠️ Risk & Real-World Impact
Worst Case
Attackers could perform HTTP response splitting to inject malicious content, hijack user sessions, or conduct cross-site scripting attacks against users.
Likely Case
HTTP header injection allowing manipulation of responses, potential cache poisoning, or limited client-side attacks.
If Mitigated
Minimal impact if input validation prevents attacker control of HTTP method strings.
🎯 Exploit Status
Exploitation requires attacker control of HTTP method input. Proof-of-concept available in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.1
Vendor Advisory: https://github.com/flutterchina/dio/issues/1130
Restart Required: Yes
Instructions:
1. Update Dio package to version 4.0.1 or later. 2. Run 'dart pub upgrade dio'. 3. Restart your Dart/Flutter application.
🔧 Temporary Workarounds
Input validation for HTTP methods
allValidate and sanitize all user input used as HTTP method strings before passing to Dio.
🧯 If You Can't Patch
- Implement strict input validation to prevent attacker control of HTTP method strings.
- Use application-level firewalls to monitor for CRLF injection patterns in HTTP requests.
🔍 How to Verify
Check if Vulnerable:
Check your pubspec.yaml or pubspec.lock file for 'dio: 4.0.0'.Check Version:
grep dio pubspec.lockVerify Fix Applied:
Verify Dio version is 4.0.1 or higher in pubspec.lock after update.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP method strings containing CRLF sequences (\r\n)
- Malformed HTTP requests with injected headers
Network Indicators:
- HTTP requests with CRLF sequences in method field
- Responses with unexpected headers or content
SIEM Query:
http.method contains "\r\n" OR http.method contains "%0D%0A"