CVE-2024-5193
📋 TL;DR
This CVE describes a CRLF injection vulnerability in Ritlabs TinyWeb Server 1.94 that allows attackers to inject arbitrary HTTP headers or split responses by manipulating request inputs containing %0D%0A (carriage return line feed). This affects anyone running TinyWeb Server 1.94 with the vulnerable request handler component exposed to network requests.
💻 Affected Systems
- Ritlabs TinyWeb Server
📦 What is this software?
Tinyweb by Ritlabs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could perform HTTP response splitting to conduct cache poisoning, cross-site scripting, or session fixation attacks against users of the web server.
Likely Case
HTTP header injection leading to cache poisoning or limited client-side attacks against users accessing the vulnerable server.
If Mitigated
If proper input validation and output encoding are implemented, the vulnerability would be prevented with minimal impact.
🎯 Exploit Status
Public exploit code is available on GitHub. The attack requires network access to the server but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.99
Vendor Advisory: https://github.com/maximmasiutin/TinyWeb/releases/tag/v1.99
Restart Required: Yes
Instructions:
1. Download TinyWeb Server version 1.99 from the official GitHub releases page. 2. Stop the running TinyWeb Server service. 3. Replace the existing installation with version 1.99. 4. Restart the TinyWeb Server service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement a web application firewall or proxy that filters %0D%0A sequences in HTTP requests
Network Segmentation
allRestrict access to TinyWeb Server to trusted networks only
🧯 If You Can't Patch
- Implement a reverse proxy with CRLF injection filtering in front of TinyWeb Server
- Monitor for unusual HTTP requests containing %0D%0A sequences and block offending IPs
🔍 How to Verify
Check if Vulnerable:
Check if TinyWeb Server version is 1.94 by examining the binary or service informationCheck Version:
On Windows: Check program properties or service details. On Linux: Check binary version or package manager.Verify Fix Applied:
Verify the installed version is 1.99 or higher and test with a proof-of-concept request containing %0D%0A📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing %0D%0A sequences
- Unusual HTTP header patterns in server logs
Network Indicators:
- HTTP requests with encoded CRLF sequences to the server port
SIEM Query:
source="tinyweb.log" AND "%0D%0A"🔗 References
- https://github.com/DMCERTCE/CRLF_Tiny
- https://github.com/maximmasiutin/TinyWeb/commit/d49c3da6a97e950975b18626878f3ee1f082358e
- https://github.com/maximmasiutin/TinyWeb/releases/tag/v1.99
- https://vuldb.com/?ctiid.265830
- https://vuldb.com/?id.265830
- https://vuldb.com/?submit.333059
- https://www.masiutin.net/tinyweb-cve-2024-5193.html
- https://github.com/DMCERTCE/CRLF_Tiny
- https://vuldb.com/?ctiid.265830
- https://vuldb.com/?id.265830
- https://vuldb.com/?submit.333059
