CVE-2021-31249

Vulnerability

A CRLF injection vulnerability exists in CHIYU BF-430, BF-431, and BF-450M TCP/IP Converter devices due to insufficient validation of the redirect= parameter across multiple CGI components. This allows an attacker to inject arbitrary CRLF sequences into HTTP responses. The vulnerability affects all firmware versions prior to the vendor's security update. [1]

Exploitation

An attacker with network access and low-privileged credentials (or default credentials) can craft a malicious HTTP request containing a CRLF payload (e.g., %0d%0a%0d%0a) in the redirect= parameter. When the device processes the request, the injected CRLF sequences are reflected in the HTTP response, enabling HTTP response splitting. This can be leveraged to perform cross-site scripting (XSS) attacks against users browsing the device's web interface. [1]

Impact

Successful exploitation allows an attacker to inject arbitrary HTTP headers or body content, leading to cross-site scripting (XSS) in the context of the device's web management interface. This can result in information disclosure, session hijacking, or redirection to malicious sites. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) indicates low confidentiality impact and no integrity or availability impact, but the scope change implies potential impact on surrounding systems. [1]

Mitigation

CHIYU Technology has released firmware updates to address this vulnerability. Users should download and install the latest firmware from the vendor's official site [2]. If updating is not immediately possible, restrict network access to the device's web interface to trusted users only.