RestSharp
Simple REST and HTTP API Client
Activity
- Latest release
- 1w ago
- Total releases
- 327
- Cadence
- ~daily
- Last 12 months
- 28
Details
- License
- Apache-2.0
- First release
- Aug 31, 2012
| Version | Released | |
|---|---|---|
114.0.1-alpha.0.10
pre
|
114.0.1-alpha.0.10
pre
Dependencies (1)
|
|
114.0.1-alpha.0.9
pre
|
114.0.1-alpha.0.9
pre
Dependencies (1)
|
|
114.0.1-alpha.0.8
pre
|
114.0.1-alpha.0.8
pre
Dependencies (1)
|
|
114.0.1-alpha.0.6
pre
|
114.0.1-alpha.0.6
pre
Dependencies (1)
|
|
114.0.1-alpha.0.5
pre
|
114.0.1-alpha.0.5
pre
Dependencies (1)
|
|
114.0.1-alpha.0.4
pre
|
114.0.1-alpha.0.4
pre
Dependencies (1)
|
|
114.0.1-alpha.0.3
pre
|
114.0.1-alpha.0.3
pre
Dependencies (1)
|
|
114.0.1-alpha.0.2
pre
|
114.0.1-alpha.0.2
pre
Dependencies (1)
|
|
114.0.0
major
|
114.0.0
major
Dependencies (1)
|
|
113.1.1-alpha.0.6
pre
|
113.1.1-alpha.0.6
pre
Dependencies (1)
|
|
113.1.1-alpha.0.5
pre
|
113.1.1-alpha.0.5
pre
Dependencies (1)
|
|
113.1.1-alpha.0.4
pre
|
113.1.1-alpha.0.4
pre
Dependencies (1)
|
|
113.1.1-alpha.0.3
pre
|
113.1.1-alpha.0.3
pre
Dependencies (1)
|
|
113.1.1-alpha.0.2
pre
|
113.1.1-alpha.0.2
pre
Dependencies (1)
|
|
113.1.0
minor
|
113.1.0
minor
Dependencies (1)
|
|
113.0.1-alpha.0.4
pre
|
113.0.1-alpha.0.4
pre
Dependencies (1)
|
|
113.0.1-alpha.0.3
pre
|
113.0.1-alpha.0.3
pre
Dependencies (1)
|
|
113.0.1-alpha.0.1
pre
|
113.0.1-alpha.0.1
pre
Dependencies (1)
|
|
113.0.0
major
|
113.0.0
major
Dependencies (1)
|
|
112.1.1-alpha.0.24
pre
|
112.1.1-alpha.0.24
pre
Dependencies (1)
|
|
112.1.1-alpha.0.19
pre
|
112.1.1-alpha.0.19
pre
Dependencies (1)
|
|
112.1.1-alpha.0.18
pre
|
112.1.1-alpha.0.18
pre
Dependencies (1)
|
|
112.1.1-alpha.0.17
pre
|
112.1.1-alpha.0.17
pre
Dependencies (1)
|
|
112.1.1-alpha.0.16
pre
|
112.1.1-alpha.0.16
pre
Dependencies (1)
|
|
112.1.1-alpha.0.14
pre
|
112.1.1-alpha.0.14
pre
Dependencies (1)
|
|
112.1.1-alpha.0.13
pre
|
112.1.1-alpha.0.13
pre
Dependencies (1)
|
|
112.1.1-alpha.0.12
pre
|
112.1.1-alpha.0.12
pre
Dependencies (1)
|
|
112.1.1-alpha.0.8
pre
|
112.1.1-alpha.0.8
pre
Dependencies (1)
|
|
112.1.1-alpha.0.4
pre
|
112.1.1-alpha.0.4
pre
Dependencies (1)
|
|
112.1.1-alpha.0.1
pre
|
112.1.1-alpha.0.1
pre
Dependencies (1)
|
|
112.1.0
minor
|
112.1.0
minor
Dependencies (1)
|
|
112.0.1-alpha.0.1
pre
|
112.0.1-alpha.0.1
pre
Dependencies (1)
|
|
112.0.0
major
|
112.0.0
major
Dependencies (1)
|
|
111.4.2-alpha.0.3
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.4.2-alpha.0.3
pre
Dependencies (1)
|
|
111.4.1
patch
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.4.1
patch
Dependencies (1)
|
|
111.4.1-alpha.0.7
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.4.1-alpha.0.7
pre
Dependencies (1)
|
|
111.4.1-alpha.0.1
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.4.1-alpha.0.1
pre
Dependencies (1)
|
|
111.4.0
minor
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.4.0
minor
Dependencies (1)
|
|
111.3.1-alpha.0.7
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.3.1-alpha.0.7
pre
Dependencies (1)
|
|
111.3.1-alpha.0.6
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.3.1-alpha.0.6
pre
Dependencies (1)
|
|
111.3.1-alpha.0.5
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.3.1-alpha.0.5
pre
Dependencies (1)
|
|
111.3.1-alpha.0.3
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.3.1-alpha.0.3
pre
Dependencies (1)
|
|
111.3.1-alpha.0.2
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.3.1-alpha.0.2
pre
Dependencies (1)
|
|
111.3.1-alpha.0.1
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.3.1-alpha.0.1
pre
Dependencies (1)
|
|
111.3.0
minor
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.3.0
minor
Dependencies (1)
|
|
111.2.1-alpha.0.6
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.2.1-alpha.0.6
pre
Dependencies (1)
|
|
111.2.1-alpha.0.5
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.2.1-alpha.0.5
pre
Dependencies (1)
|
|
111.2.1-alpha.0.3
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.2.1-alpha.0.3
pre
Dependencies (1)
|
|
111.2.1-alpha.0.2
pre
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.2.1-alpha.0.2
pre
Dependencies (1)
|
|
111.2.0
minor
1 CVE
CVE-2024-45302
GHSA-4rr6-2v9v-wcpc
Aug 29, 2024
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
Medium
Network
Low
None
SummaryThe second argument to DetailsThe way HTTP headers are added to a request is via the This means that any headers from a PoCThe below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header: This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF): The application intends to send a single request of the form: But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent: and This can be confirmed by checking the access logs on the server where these commands were run (with ImpactIf an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation. Affected versions
107.0.0
107.0.1
107.0.2
107.0.3
107.1.0
107.1.1
107.1.2
107.2.0
107.2.1
107.3.0
108.0.0
108.0.1
+ 14 more Show less
108.0.2
108.0.3
108.0.4
109.0.0
109.0.1
110.0.0
110.1.0
110.2.0
111.0.0
111.1.0
111.2.0
111.3.0
111.4.0
111.4.1
Fixed in
112.0.0
References
Updated Oct 01, 2024 · Source: OSV.dev |
111.2.0
minor
Dependencies (1)
|