Update dependency RestSharp to v112 [SECURITY] - autoclosed #417
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
WalkthroughThe changes involve updating the Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant RestSharp
participant Server
Client->>RestSharp: Send HTTP Request
RestSharp->>Server: Forward Request
Server-->>RestSharp: Send Response
RestSharp-->>Client: Return Response
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (5)
- generic jobs/RabbitMQCheck/RabbitMQCheck.csproj (1 hunks)
- nuget packages/AigSmsHook/AigSmsHook.csproj (1 hunks)
- nuget packages/Planar.Client/Planar.Client.csproj (1 hunks)
- src/Jobs/RestJob/RestJob.csproj (1 hunks)
- src/Planar.CLI/Planar.CLI.csproj (1 hunks)
Additional comments not posted (5)
nuget packages/AigSmsHook/AigSmsHook.csproj (1)
11-11: LGTM! But verify the package usage in the codebase.The update to
RestSharpversion112.0.0is necessary to address the security vulnerability GHSA-4rr6-2v9v-wcpc. Ensure that the new version does not introduce breaking changes in the codebase.The code changes are approved.
Run the following script to verify the package usage:
src/Jobs/RestJob/RestJob.csproj (1)
25-25: LGTM! But verify the package usage in the codebase.The update to
RestSharpversion112.0.0is necessary to address the security vulnerability GHSA-4rr6-2v9v-wcpc. Ensure that the new version does not introduce breaking changes in the codebase.The code changes are approved.
Run the following script to verify the package usage:
generic jobs/RabbitMQCheck/RabbitMQCheck.csproj (1)
15-15: LGTM! But verify the package usage in the codebase.The update to
RestSharpversion112.0.0is necessary to address the security vulnerability GHSA-4rr6-2v9v-wcpc. Ensure that the new version does not introduce breaking changes in the codebase.The code changes are approved.
Run the following script to verify the package usage:
nuget packages/Planar.Client/Planar.Client.csproj (1)
35-35: LGTM! But verify for breaking changes.The update to
RestSharpversion112.0.0addresses a security vulnerability related to CRLF injection. Ensure that the new version does not introduce breaking changes that could affect the application's functionality.The code changes are approved.
Run the following script to verify for breaking changes:
src/Planar.CLI/Planar.CLI.csproj (1)
47-47: LGTM! But verify for breaking changes.The update to
RestSharpversion112.0.0addresses a security vulnerability related to CRLF injection. Ensure that the new version does not introduce breaking changes that could affect the application's functionality.The code changes are approved.
Run the following script to verify for breaking changes:
renovate
bot
changed the title
This PR contains the following updates:
111.4.1->112.0.0GitHub Vulnerability Alerts
CVE-2024-45302
Summary
The second argument to
RestRequest.AddHeader(the header value) is vulnerable to CRLF injection. The same applies toRestRequest.AddOrUpdateHeaderandRestClient.AddDefaultHeader.Details
The way HTTP headers are added to a request is via the
HttpHeaders.TryAddWithoutValidationmethod: https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32 This method does not check for CRLF characters in the header value.This means that any headers from a
RestSharp.RequestHeadersobject are added to the request in such a way that they are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests.PoC
The below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the "Authorization" header:
This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF):
The application intends to send a single request of the form:
But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent:
and
This can be confirmed by checking the access logs on the server where these commands were run (with
insert.some.site.herepointing to localhost):Impact
If an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery.
Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation.
Release Notes
restsharp/RestSharp (RestSharp)
v112.0.0Compare Source
What's Changed
New Contributors
Full Changelog: restsharp/RestSharp@111.4.1...112.0.0
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.