h3 EventStream Carriage Return Injection Vulnerability

Executive Summary

This vulnerability affects h3 library versions before 1.15.9. It involves improper sanitization of carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary Server-Sent Events (SSE). The issue bypasses a prior fix that only addressed newline injection, enabling three attack scenarios: event type spoofing, message boundary injection, and comment-to-data escalation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of the h3 library in use. If it is before 1.15.9 or between 2.0.0-beta.0 and 2.0.1-rc.17, the system is vulnerable. Inspect EventStream data and comment fields for unsanitized carriage return characters (` `).

Commands to check library version: grep "h3" package.json or npm list h3. Monitor network traffic for malformed SSE responses containing ` ` in event fields or comments.

Useful 0 Not Useful 0

Impact Analysis

Attackers could manipulate event streams to spoof event types, split single push calls into multiple events, or inject malicious data via comments. This could lead to unauthorized data exposure, session hijacking, or other malicious activities depending on the application's use of SSE.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical flaw in input sanitization for Server-Sent Events (SSE) in the h3 library. However, if exploited, it could lead to unauthorized data exposure or manipulation, which may indirectly impact compliance by violating data integrity or confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the h3 library to version 1.15.9 or later. If using the 2.x branch, upgrade to a version beyond 2.0.1-rc.17. Review and sanitize all EventStream data and comment fields to remove carriage return characters before processing.

Useful 0 Not Useful 0