Improper Input Validation in guzzlehttp/psr7

Vulnerability

The guzzlehttp/psr7 PSR-7 HTTP message library versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a newline character (CR or LF) into header values, allowing untrusted data to be injected into HTTP headers [3]. The library did not validate that header values conform to RFC 7230 section 3.2.4, which specifies that only visible ASCII characters and spaces/tabs are allowed in field values [1]. The fix was implemented in commit 9a96d9db668b485361ed9de7b5bf1e54895df1dc [4].

Exploitation

An attacker who can control header values passed to the library (e.g., by manipulating user input that is later used as a header value in an HTTP request or response) can inject a newline character (\n or \r\n). No special network position is required beyond the ability to supply the header value; this could be a user or another process passing untrusted input to guzzlehttp/psr7. The attacker does not require authentication if the application accepts untrusted header input. The sequence is: the attacker crafts a payload containing a newline and further header lines, which the library then places into the outgoing message [3].

Impact

Successful exploitation leads to HTTP header injection. Depending on how the header is used downstream, this can result in request smuggling, response splitting, cache poisoning, or cross-site scripting (if the header is reflected). The attacker may be able to bypass security controls or perform actions with the privilege of the affected server or client [3]. The CIA impact is primarily integrity and availability (via cache poisoning or request smuggling), with potential confidentiality breaches.

Mitigation

The issue is patched in versions 1.8.4 and 2.1.1, both released in March 2022 [3]. Users should upgrade immediately. The 1.x branch is now end-of-life (EOL) as of 2024-06-30 [2]; users on 1.x are strongly encouraged to migrate to the 2.x series. There are currently no known workarounds [3].