Miggo Logo
Miggo Vulnerability Database
→
GHSA-mgr7-5782-6jh9

GHSA-mgr7-5782-6jh9:
The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-mgr7-5782-6jh9
EPSS Score
-
CWE
CWE-93
Published
1/13/2025
Updated
1/13/2025
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
Umbraco.Headless.Client.Netnuget<= 1.4.11.5.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from Refit's header handling implementation. The Refit advisory explicitly shows vulnerable code at Refit/RequestBuilderImplementation.cs line 1328 where HttpHeaders.TryAddWithoutValidation is used to add headers without CRLF validation. While Umbraco's client doesn't directly use this method, the transient Refit dependency exposes the vulnerability to applications using Refit's [Header], [HeaderCollection] or [Authorize] attributes. The root cause is clearly identified in Refit's request builder implementation where unvalidated headers are added.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** ***rt*or* ****l*ss *li*nt li*r*ry **p*n*s on [R**it ](*ttps://*it*u*.*om/r***tiv*ui/r**it) to *ssist in m*kin* *TTP r*qu*sts to ***rt*or* pu*li* *PIs. R**it r***ntly pu*lis*** *n **visory r***r*in* * *RL* inj**tion vuln*r**ility w**r**

Reasoning

T** vuln*r**ility st*ms *rom R**it's *****r **n*lin* impl*m*nt*tion. T** R**it **visory *xpli*itly s*ows vuln*r**l* *o** *t R**it/R*qu*st*uil**rImpl*m*nt*tion.*s lin* **** w**r* *ttp*****rs.Try***Wit*outV*li**tion is us** to *** *****rs wit*out *RL*