CVE-2023-29197

guzzlehttp/psr7 < 1.9.1 & 2.4.5 - Interpretation Conflict

2023-04-17 00:00

Strategic Overview

Status: Patched in 1.6.4
Affected Plugin: WP Offload SES Lite
Affected Version: < 1.6.4
CVSS: 5.3Medium
Weakness type: CWE-436 · Interpretation Conflict
CVE: CVE-2023-29197

View all WP Offload SES Lite vulnerabilities

At a glance

CVE-2023-29197 is a medium-severity Interpretation Conflict vulnerability in the WP Offload SES Lite WordPress plugin, affecting versions < 1.6.4. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.6.4; sites on affected versions should update now. Disclosed April 2023.

Vulnerability Overview

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade. While some WordPress plugins and themes may be using this library, it does not make them vulnerable to exploitation.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-436: Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Remediation

Update to version 1.6.4, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: WP Offload SES Lite 1.6.4 closes this, and updating the plugin is the step that ends it.

Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2023-29197 https://www.wordfence.com/threat-intel/vulnerabilities/id/2638bb80-7066-45c0-ab74-4ba407d50cae https://nvd.nist.gov/vuln/detail/CVE-2023-29197

Related records

Other vulnerabilities in WP Offload SES Lite

5.4CVE-2021-24494: WP Offload SES Lite <= 1.4.4 Stored XSSCVE-2021-24494

CVSS Vector

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityNone

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/