CVE-2020-35669
MEDIUMdart/http < 0.12.2 and Pub/http < 0.13.3 - CRLF Injection via HTTP Method
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-35669. PoCs published by n0npax.
AI-analyzed exploit summary This repository demonstrates a header injection vulnerability in the Dart HTTP library (CVE-2020-35669) where user-controlled input in the Request constructor can manipulate HTTP headers, potentially leading to SSRF or request smuggling attacks. The PoC shows how a crafted request can bypass intended host restrictions when behind a reverse proxy.
Description
An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.
Exploits (1)
This repository demonstrates a header injection vulnerability in the Dart HTTP library (CVE-2020-35669) where user-controlled input in the Request constructor can manipulate HTTP headers, potentially leading to SSRF or request smuggling attacks. The PoC shows how a crafted request can bypass intended host restrictions when behind a reverse proxy.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N