Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-31402

CVE-2021-31402: dio vulnerable to CRLF injection with HTTP method string

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-31402
GHSA ID
GHSA-9324-jv53-9cc8
EPSS Score
0.57017%
CWE
CWE-93
Published
3/21/2023
Updated
10/5/2023
KEV Status
No
Technology
TechnologyDart

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
diopub< 5.0.05.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing validation of the HTTP method string before constructing requests. The patch introduced the _isValidToken validation check in _transformData, which was absent in vulnerable versions. Since _transformData is the entry point for request processing and directly used the unvalidated options.method parameter, its lack of validation made it the vulnerable entry point for CRLF injection.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** *io p**k*** *.*.* *or **rt *llows *RL* inj**tion i* t** *tt**k*r *ontrols t** *TTP m*t*o* strin*, * *i***r*nt vuln*r**ility t**n *V*-****-*****. ### P*t***s T** vuln*r**ility **s ***n r*solv** *y *ttps://*it*u*.*om/**u*/*io/*ommit/***

Reasoning

T** vuln*r**ility st*ms *rom missin* v*li**tion o* t** *TTP m*t*o* strin* ***or* *onstru*tin* r*qu*sts. T** p*t** intro*u*** t** _isV*li*Tok*n v*li**tion ****k in _tr*ns*orm**t*, w*i** w*s **s*nt in vuln*r**l* v*rsions. Sin** _tr*ns*orm**t* is t** *n