CVE-2022-29631
📋 TL;DR
CVE-2022-29631 is a CRLF injection vulnerability in Jodd HTTP library that allows attackers to perform Server-Side Request Forgery (SSRF) attacks. By injecting malicious carriage return and line feed characters in HTTP requests, attackers can make the vulnerable server send requests to internal systems. This affects applications using Jodd HTTP v6.0.9 for HTTP client functionality.
💻 Affected Systems
- Jodd HTTP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network via SSRF to access sensitive internal services, potentially leading to data exfiltration or lateral movement.
Likely Case
Information disclosure from internal services, reconnaissance of internal network, or limited data access via SSRF.
If Mitigated
Limited impact with proper network segmentation and egress filtering preventing internal service access.
🎯 Exploit Status
Exploitation requires user input to be passed to vulnerable HttpRequest methods. Public GitHub issues demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v6.0.10 and later
Vendor Advisory: https://github.com/oblac/jodd-http/issues/9
Restart Required: Yes
Instructions:
1. Update Jodd HTTP dependency to v6.0.10 or later. 2. Update pom.xml or build.gradle with new version. 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize all user input before passing to HttpRequest.set() and HttpRequest.send() methods
Network Segmentation
allImplement strict egress filtering to prevent SSRF attacks from reaching internal services
🧯 If You Can't Patch
- Implement WAF rules to detect and block CRLF injection patterns in HTTP requests
- Deploy network monitoring to detect unusual outbound requests from affected systems
🔍 How to Verify
Check if Vulnerable:
Check if application uses Jodd HTTP v6.0.9 via dependency management files (pom.xml, build.gradle) or by examining deployed libraries.Check Version:
Check build configuration files or run: java -cp "jodd-http-*.jar" -versionVerify Fix Applied:
Confirm Jodd HTTP version is v6.0.10 or later and test that CRLF injection attempts are properly rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from application
- Failed CRLF injection attempts in application logs
- Unexpected HTTP response headers
Network Indicators:
- HTTP requests with encoded CRLF characters (%0D%0A)
- Requests to internal IP addresses from application servers
- Unusual destination ports in outbound traffic
SIEM Query:
source="application_logs" AND (message CONTAINS "%0D%0A" OR message CONTAINS "CRLF")