CVE-2024-45302 describes a CRLF injection vulnerability in the RestSharp .NET library, specifically affecting the AddHeader, AddOrUpdateHeader, and AddDefaultHeader methods. This flaw allows attackers to inject additional HTTP headers or smuggle entire HTTP requests if user-controlled input is passed to these methods. Rated 7.8 HIGH on CVSS, the vulnerability has a local attack vector with low complexity, but can lead to high impact on confidentiality, integrity, and availability, particularly in web applications where it can enable request splitting and Server-Side Request Forgery. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog. RestSharp has released a fix in version 112.0.0, and users are advised to upgrade immediately as no workarounds exist.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 107.0.0, < 112.0.0CPE matchmatch criteria | cpe:2.3:a:restsharp:restsharp:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.