CVE-2022-35507

HIGHNuclei

Proxmox - CRLF Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-35507 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 24, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryHIGHProxmox - CRLF InjectionCVSS 7.1

A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.

Impact

Attackers can inject response headers with CRLF characters to set malicious cookies in victims' Chromium-based browsers, causing client-side denial of service and potentially facilitating session fixation attacks on Proxmox users.

Remediation

Update pve-http-server to version 4.1-3 or later that properly validates and strips CRLF characters from response headers.

WeaknessesCWE-74
AuthorsDhiyaneshDk
Template tagscvecve2022proxmoxcrlfvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CPE: cpe:2.3:a:proxmox:proxmox_mail_gateway:-:*:*:*:*:*:*:*
Shodan: html:"Proxmox = {"
https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae0241811093155000486da171379c23c2 https://github.com/advisories/GHSA-xfgp-gpjw-wmqr https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/#bug-0x02-crlf-injection-in-response-headers

Source: ProjectDiscovery

References

4