Listen to this Post
How the CVE Works
Litestar fails to sanitize URL paths when logging exceptions, enabling CRLF injection if debug logging or `log_exceptions=”always”` is enabled. Attackers inject `%0d%0a` (URL-encoded CRLF) into paths, forging malicious log entries. The default exception handler directly formats unescaped paths into logs, allowing newline injection. Exploits require misconfigured logging (e.g., copied from docs) or debug mode. Malicious requests bypass 404 stack trace filters by triggering 400/500 errors.
DailyCVE Form
Platform: Litestar
Version: <1.0.0
Vulnerability: CRLF Injection
Severity: Medium
Date: 2024-07-15
Prediction: Patch by 2024-09-30
What Undercode Say
curl "http://target/%0d%0aFAKE_LOG_ENTRY"
Example vulnerable config
logging_config = {"log_exceptions": "always"}
How Exploit
1. Craft URL with `%0d%0a` payload.
2. Trigger exception (e.g., invalid endpoint).
3. Forged log entry appears.
Protection from this CVE
- Disable
log_exceptions="always". - Sanitize URL paths in logs.
- Avoid debug logging in production.
Impact
- Log forgery.
- Audit evasion.
- Misleading diagnostics.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
