Loading vulnerability…
HTTP Header Injection and Response Splitting in Undertow
CVE-2016-4993 is an HTTP header-injection and HTTP response-splitting vulnerability in the Undertow web server used by WildFly 10.0.0 and Red Hat JBoss Enterprise Application Platform 7 releases before 7.0.2. Insufficient sanitization and validation of user-controlled input before its inclusion in an HTTP header value permits CRLF injection, allowing arbitrary HTTP headers to be injected and HTTP responses to be split.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can inject arbitrary HTTP headers and split HTTP responses. CRLF characters in HTTP headers can allow control of subsequent headers and message bodies or creation of additional attacker-controlled HTTP messages.
If you can’t patch tonight, do this now.
Where immediate patching is not possible, ensure application code rejects or properly encodes CR and LF characters and other control characters in all user-controlled values used to generate HTTP response headers. Minimize direct reflection of request-derived input into response headers and use framework-supported header-setting APIs with strict validation.
Patch, then assume compromise.
Upgrade affected Red Hat JBoss EAP 7 deployments to the vendor-fixed packages, including EAP 7.0.2 where applicable. Back up the EAP installation and deployed applications before updating, and restart the JBoss server process after installation for the fixes to take effect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.