HTTP Header Injection in KUSANAGI

Executive Summary

KUSANAGI by GMO Prime Strategy has an HTTP header injection flaw due to improper neutralization of CRLF sequences. This allows attackers to inject arbitrary HTTP headers into responses when users access a specially crafted URL. The issue affects WordPress profiles in KUSANAGI versions 7, 8, and 9, including Free, Business, Premium, Security, and Enterprise Editions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your KUSANAGI version is affected by running `dnf list installed kusanagi` or `kusanagi version`. Affected versions include KUSANAGI 9 (9.12.2-1 and earlier) and KUSANAGI 10 Security/Enterprise (10.7.2-1 and earlier). Verify if your system uses Nginx by checking `systemctl status nginx`. Inspect Nginx configuration files for the vulnerable rewrite rule in `/etc/opt/kusanagi/nginx/conf.d/{profile_name}.wp.inc` or `/etc/nginx/conf.d/{profile_name}_http.conf` and `/etc/nginx/conf.d/{profile_name}_ssl.conf`.

• Check KUSANAGI version with `dnf list installed kusanagi` or `kusanagi version`.
• Verify Nginx usage with `systemctl status nginx`.
• Inspect configuration files for vulnerable rewrite rules in specified paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to inject malicious HTTP headers, potentially leading to session hijacking, cache poisoning, or bypassing security controls. It may also enable phishing attacks or unauthorized access to sensitive data if exploited via crafted URLs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, violating GDPR's data protection principles or HIPAA's security requirements. Non-compliance risks include fines, legal penalties, and reputational damage due to potential breaches of confidentiality or integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update KUSANAGI to a patched version using `dnf upgrade kusanagi`. For Free/Business/Premium Editions, upgrade to KUSANAGI 9.12.3-1 or later. For Security/Enterprise Editions, upgrade to KUSANAGI 10.7.3-1 or later. If updating is not possible, manually edit the Nginx configuration files to replace the vulnerable rewrite rule and reload Nginx. For KUSANAGI 9, change the line in `/etc/opt/kusanagi/nginx/conf.d/{profile_name}.wp.inc` and run `kusanagi nginx --reload`. For KUSANAGI 7/8, edit files in `/etc/nginx/conf.d/` and restart Nginx.

• Update KUSANAGI using `dnf upgrade kusanagi` to the latest version.
• If update is not possible, modify the Nginx configuration files to fix the rewrite rule.
• Reload or restart Nginx after making changes.

Useful 0 Not Useful 0