CVE-2024-45302
📋 TL;DR
RestSharp versions before 112.0.0 are vulnerable to CRLF injection in HTTP headers, allowing attackers to inject malicious headers or smuggle HTTP requests when user-controlled data is passed to header values. This affects any .NET application using RestSharp that processes untrusted input in HTTP headers, potentially leading to request splitting and server-side request forgery (SSRF).
💻 Affected Systems
- RestSharp
📦 What is this software?
Restsharp by Restsharp
⚠️ Risk & Real-World Impact
Worst Case
Full SSRF allowing internal network reconnaissance, data exfiltration, or chained attacks against internal services
Likely Case
HTTP request smuggling leading to cache poisoning, session hijacking, or web cache deception
If Mitigated
Limited impact with proper input validation and header sanitization
🎯 Exploit Status
Exploitation requires user input to reach vulnerable header methods; public PoC demonstrates request splitting
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 112.0.0
Vendor Advisory: https://github.com/restsharp/RestSharp/security/advisories/GHSA-4rr6-2v9v-wcpc
Restart Required: Yes
Instructions:
1. Update RestSharp NuGet package to version 112.0.0 or later
2. Rebuild and redeploy affected applications
3. Test functionality after update
🔧 Temporary Workarounds
Input Validation and Sanitization
allValidate and sanitize all user input before passing to RestSharp header methods
// C# example: Validate header values
if (headerValue.Contains("\r\n") || headerValue.Contains("\n"))
{
throw new ArgumentException("Invalid header value");
}
🧯 If You Can't Patch
- Implement strict input validation to reject CRLF sequences in header values
- Use allowlists for header values and sanitize all user input before processing
🔍 How to Verify
Check if Vulnerable:
Check RestSharp package version in project files or NuGet packages; versions <112.0.0 are vulnerableCheck Version:
dotnet list package | findstr RestSharpVerify Fix Applied:
Verify RestSharp version is 112.0.0 or higher in package manager and rebuild application📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP headers with CRLF sequences
- Multiple HTTP requests in single log entry
- Unexpected internal service calls
Network Indicators:
- HTTP requests with malformed headers
- Requests containing \r\n sequences in header values
SIEM Query:
search index=web_logs "\r\n" OR "%0d%0a" in header_values🔗 References
- https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32
- https://github.com/restsharp/RestSharp/commit/0fba5e727d241b1867bd71efc912594075c2934b
- https://github.com/restsharp/RestSharp/security/advisories/GHSA-4rr6-2v9v-wcpc
