bugtraq - Re: CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File Transfer Plugin for Android

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 24 Sep 2015 12:48:44 -0700
From: Shazron <shazron@...che.org>
To: bugtraq@...urityfocus.com
Cc: "private@...dova.apache.org" <private@...dova.apache.org>,
  "dev@...dova.apache.org" <dev@...dova.apache.org>
Subject: Re: CVE-2015-5204: HTTP header injection vulnerability in Apache
 Cordova File Transfer Plugin for Android

CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File
Transfer Plugin for Android

Severity:
 Medium

Vendor:
 The Apache Software Foundation

Versions Affected:
 Cordova Android File Transfer Plugin  (1.2.1 and below)

Description:
 Android applications built with the Cordova framework that use the File
 Transfer Plugin can have the HTTP headers set by that plugin be manipulated
 by the filename being uploaded.  This allows for for cookies to be forged
 by the Cordova application, or for the file payload to be replaced in some
 situations.  Remotely hosted applications and applications developed with
 Cordova that allow the user to manually enter the filename are
 especially vulnerable to this issue.

Upgrade path:
 Developers who are concerned about this issue should install version 1.3.0
 or higher of the Cordova File Transfer Plugin and rebuild their
 applications.  This plugin now conforms with RFC-2616 and no longer allows
 non-ASCII characters and control characters in header names or values.
 Any non-ASCII characters will be removed from the header.  Developers
should be aware,
 and encode these characters before adding the values to the header.

Credit:
 This issue was discovered by Muneaki Nishimura (Sony Digital Network
Applications, Inc.)