CVE-2024-45597
Pluto's http.request allows CR and LF in header values
Résumé
Pluto's http.request allows CR and LF in header values
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com