Executive Summary

The HTTP Headers plugin for WordPress has a vulnerability known as CRLF Injection in all versions up to and including 1.19.2. This occurs because the plugin does not properly sanitize custom header names and values before writing them to the Apache .htaccess file using the insert_with_markers() function.

An attacker with Administrator-level access or higher can exploit this by injecting arbitrary newline characters and additional Apache directives into the .htaccess configuration file through the 'Custom Headers' settings.

This injection can cause Apache configuration parse errors and potentially lead to a site-wide denial of service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated attacker with Administrator-level access to inject malicious directives into your Apache .htaccess file.

Such injection can cause Apache configuration parse errors, which may result in a site-wide denial of service, making your website unavailable to users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves injection of arbitrary newline characters and Apache directives into the .htaccess file via the 'Custom Headers' settings in the HTTP Headers WordPress plugin.

To detect this vulnerability on your system, you should check the .htaccess file for unexpected or suspicious Apache directives or newline characters that were not intentionally added.

Since the vulnerability requires Administrator-level access to exploit, reviewing recent changes to the .htaccess file and auditing the 'Custom Headers' settings in the WordPress HTTP Headers plugin is recommended.

• Use command-line tools to inspect the .htaccess file, for example: `cat /path/to/.htaccess` or `less /path/to/.htaccess`.
• Search for suspicious or unexpected Apache directives or newline characters using: `grep -P '\n' /path/to/.htaccess` or `grep -E 'RewriteRule|Redirect|<IfModule>' /path/to/.htaccess`.
• Audit WordPress plugin settings via the admin interface to review any custom headers configured.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing or updating the vulnerable HTTP Headers plugin to a version later than 1.19.2 where the issue is fixed.

Restrict Administrator-level access to trusted users only, as exploitation requires such privileges.

Review and sanitize any custom header name and value fields configured in the plugin to ensure they do not contain newline characters or malicious Apache directives.

Manually inspect and clean the .htaccess file to remove any injected malicious directives or malformed entries.

Consider temporarily disabling the HTTP Headers plugin until a patched version is applied.

Useful 0 Not Useful 0