CVE-2023-29530
📋 TL;DR
This vulnerability in Laminas Diactoros allows attackers to cause denial of service or application errors by injecting newline characters in HTTP header keys or values. It affects users who create HTTP requests/responses with user-supplied header values. The vulnerability impacts all applications using affected versions of laminas/laminas-diactoros.
💻 Affected Systems
- laminas/laminas-diactoros
📦 What is this software?
Fedora by Fedoraproject
Laminas Diactoros by Getlaminas
Laminas Diactoros by Getlaminas
Laminas Diactoros by Getlaminas
Laminas Diactoros by Getlaminas
Laminas Diactoros by Getlaminas
Laminas Diactoros by Getlaminas
Laminas Diactoros by Getlaminas
Laminas Diactoros by Getlaminas
Psr 7 by Guzzlephp
Psr 7 by Guzzlephp
⚠️ Risk & Real-World Impact
Worst Case
Complete application denial of service, making the service unavailable to legitimate users.
Likely Case
Application errors and partial service disruption when processing malformed HTTP headers.
If Mitigated
No impact if headers are properly validated and newlines are stripped before processing.
🎯 Exploit Status
Exploitation requires ability to supply HTTP header values to the application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, 2.25.1
Vendor Advisory: https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36
Restart Required: No
Instructions:
1. Update laminas/laminas-diactoros to the patched version corresponding to your major version. 2. Run composer update laminas/laminas-diactoros. 3. Deploy the updated application.
🔧 Temporary Workarounds
Validate and sanitize HTTP headers
allStrip leading/trailing newline characters from user-supplied header keys and values before calling withHeader()
// PHP example: $headerValue = trim($userInput, "\r\n");
🧯 If You Can't Patch
- Implement input validation to strip newline characters from all user-supplied HTTP header values
- Implement rate limiting and monitoring to detect and block DoS attempts
🔍 How to Verify
Check if Vulnerable:
Check composer.json or run composer show laminas/laminas-diactoros to see installed versionCheck Version:
composer show laminas/laminas-diactoros | grep versionsVerify Fix Applied:
Verify version is 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, or 2.25.1📡 Detection & Monitoring
Log Indicators:
- Application errors related to HTTP message parsing
- Unexpected application crashes or restarts
Network Indicators:
- HTTP requests with newline characters in headers
SIEM Query:
search 'HTTP header contains newline' OR 'malformed HTTP request'🔗 References
- https://github.com/advisories/GHSA-wxmh-65f7-jcvw
- https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336/
- https://github.com/advisories/GHSA-wxmh-65f7-jcvw
- https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336/
