CVE-2022-50682

Executive Summary

CVE-2022-50682 is a CRLF injection vulnerability in the Kentico Xperience content management system. The flaw resides in the routing engine, where improper encoding of URL query string redirects allows an attacker to inject carriage return and line feed characters. This can lead to HTTP response header injection, potentially enabling cache poisoning, session fixation, or cross-site scripting (XSS) attacks. The vulnerability has a CVSS score of 0.0 in the NVD, but based on the technical impact, a more realistic score is 5.4 (Medium). No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not provided a patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects the proprietary Kentico Xperience CMS, which is a .NET-based commercial product. Organizations using Kentico Xperience should treat this as a critical supply chain risk due to the lack of vendor response.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited ability to modify data or headers.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for chaining with other attacks (e.g., XSS, cache poisoning) elevates the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability exists in the routing engine of Kentico Xperience. When processing URL query string redirects, the application fails to properly encode or sanitize user-supplied input. An attacker can inject CRLF sequences (%0d%0a or \r\n) into the redirect URL, causing the server to interpret these characters as header delimiters.

Technical Flow:

1. The attacker crafts a malicious URL containing CRLF sequences in the query string parameter that controls the redirect target.
2. The Kentico routing engine processes the URL without encoding the CRLF characters.
3. The server constructs an HTTP response with a Location header that includes the injected CRLF.
4. The injected CRLF allows the attacker to terminate the original header and inject arbitrary HTTP headers (e.g., Set-Cookie, X-Forwarded-For).
5. This can lead to:
   • HTTP Response Splitting: Splitting the response body into two separate HTTP responses.
   • Cache Poisoning: Injecting malicious content into web caches.
   • Session Fixation: Setting a known session ID via injected Set-Cookie header.
   • Cross-Site Scripting (XSS): If the injected content is reflected in the response body.

Root Cause: The application uses a vulnerable function to handle redirects that does not perform input validation or output encoding for CRLF characters. The fix would involve using a safe redirect method that URL-encodes the redirect target or rejects invalid characters.

Vulnerable vs. Patched Code

Since no official patch has been released, the following is a hypothetical comparison based on common CRLF injection fixes.

Vulnerable Code (C# example):

public ActionResult Redirect(string url)
{
    // Directly using user input in redirect without encoding
    return Redirect(url);
}

Patched Code (C# example):

public ActionResult Redirect(string url)
{
    // Validate and encode the URL to prevent CRLF injection
    if (Uri.TryCreate(url, UriKind.Absolute, out Uri uri))
    {
        string safeUrl = uri.AbsoluteUri.Replace("\r", "").Replace("\n", "");
        return Redirect(safeUrl);
    }
    else
    {
        return RedirectToAction("Error");
    }
}

Key Differences:

• The patched code validates the URL using Uri.TryCreate.
• It removes CR and LF characters from the URL before passing it to the redirect method.
• It falls back to an error page if the URL is invalid.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of Kentico Xperience (version unknown).
• Ability to craft HTTP requests.

Exploitation Steps:

1. Identify a redirect endpoint in the application (e.g., /redirect?url=).
2. Craft a malicious URL with CRLF injection:

   http://target.com/redirect?url=http://evil.com%0d%0aSet-Cookie:%20sessionid=malicious%0d%0a
   

3. Send the request to the server.
4. The server responds with a Location header that includes the injected Set-Cookie header.
5. The victim's browser processes the injected header, setting a malicious session cookie.

Example Request:

GET /redirect?url=http://evil.com%0d%0aSet-Cookie:%20sessionid=attacker-controlled HTTP/1.1
Host: target.com

Expected Response:

HTTP/1.1 302 Found
Location: http://evil.com
Set-Cookie: sessionid=attacker-controlled
Content-Length: 0

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing %0d%0a or \r\n in query string parameters.
• Use WAF rules to block requests with CRLF sequences in redirect URLs.
• Implement input validation on the server side to reject URLs containing CRLF characters.

Hunting Queries:

• Search for HTTP responses with multiple Set-Cookie headers or unexpected headers.
• Look for redirect responses where the Location header contains encoded CRLF characters.

Lab Setup:

• Use a local instance of Kentico Xperience (if available) or a simulated environment.
• Tools: Burp Suite, OWASP ZAP, curl, netcat.

Testing Command:

curl -v "http://target.com/redirect?url=http://evil.com%0d%0aX-Injected:%20test"

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing %0d%0a or %0a in query string parameters.
  • HTTP responses with multiple Location headers or unexpected headers.
  • Unusual Set-Cookie headers in redirect responses.

• File IOCs:

  • Web server logs showing requests with CRLF sequences.
  • Cache entries with injected content.

• Behavioral IOCs:

  • Unexpected redirects to external domains.
  • Session fixation attempts (e.g., same session ID across multiple users).

Detection Engineering

YARA Rule

rule CVE_2022_50682_CRLF_Injection {
    meta:
        description = "Detects CRLF injection attempts in Kentico Xperience redirect URLs"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2022-50682"
    strings:
        $crlf1 = "%0d%0a" nocase
        $crlf2 = "%0a" nocase
        $crlf3 = "%0d" nocase
        $redirect = "/redirect?url=" nocase
    condition:
        any of ($crlf*) and $redirect
}

Sigma Rule

title: CVE-2022-50682 CRLF Injection in Kentico Xperience
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with CRLF sequences in redirect URLs targeting Kentico Xperience
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - '%0d%0a'
            - '%0a'
            - '%0d'
        cs-uri-stem|contains: '/redirect'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-50682 CRLF Injection in Kentico Xperience"; flow:to_server; content:"/redirect?url="; http_uri; content:"%0d%0a"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Redirect Functionality: If possible, disable the vulnerable redirect endpoint until a patch is available.
2. Web Application Firewall (WAF): Deploy WAF rules to block requests containing CRLF sequences (%0d%0a, %0a, %0d) in query string parameters.
3. Input Validation: Implement server-side validation to reject URLs containing CRLF characters.
4. Output Encoding: Ensure all redirect URLs are URL-encoded before being sent in the Location header.

Long-Term Fix:

• Contact Kentico support for an official patch or upgrade to a patched version.
• If using a custom redirect implementation, replace it with a secure method that uses Uri.TryCreate and strips CRLF characters.

Workaround:

• Use a reverse proxy (e.g., Nginx, Apache) to rewrite or block requests with CRLF sequences.
• Example Nginx rule:

if ($args ~* "%0d%0a|%0a|%0d") {
    return 403;
}

Monitoring:

• Enable logging of all redirect requests and monitor for suspicious patterns.
• Set up alerts for multiple Set-Cookie headers in a single response.

Valters IT
Securing Digital Frontiers