Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection

A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

对CRLF序列的转义处理不恰当(CRLF注入)

mod_cluster 注入漏洞

mod_cluster是mod_cluster项目的一个基于httpd的负载均衡器。 mod_cluster存在注入漏洞，该漏洞源于decodeenc函数存在CRLF注入，可能导致绕过输入验证。

N/A

N/A