Host Header Injection Vulnerability Leads to Denial of Service
CVE-2024-1064

7.5HIGH

Key Information:

Vendor: Arcadia Technology, Llc
Status: Crafty Controller
Vendor: CVE Published:; 3 February 2024

🔔 Create Arcadia Technology, Llc Vulnerability Alert

What is CVE-2024-1064?

A host header injection vulnerability exists in the HTTP handler component of Crafty Controller. This flaw permits unauthorized remote attackers to modify the host header, which may lead to a Denial of Service (DoS) condition. Exploiting this vulnerability allows attackers to disrupt the availability of the service by triggering unexpected behavior in the application's request handling process.

Affected Version(s)

Crafty Controller 4.0.0 <= 4.2.2

References

https://gitlab.com/crafty-controller/crafty-4/-/issues/327

issue-tracking

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Feb 3, 2024
Vulnerability Reserved
Jan 30, 2024

Credit

Thanks to [ebartz1](https://gitlab.com/ebartz1) on GitLab for initially reporting this issue