CyberRota Analysis
AI-GeneratedKirby CMS versions prior to 4.9.4 and 5.4.4 are vulnerable to HTTP header injection due to improper handling of untrusted data in the headers option of the Kirby Http Remote class. This flaw could allow attackers to inject unintended request headers, potentially leading to unauthorized actions on remote services. Developers and administrators using affected versions should prioritize upgrading to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request(), Remote::get(), and Remote::post(), to send outgoing HTTP requests with untrusted data in the headers option could allow newline characters in a header value to inject a separate unintended request header to the remote service. This issue is fixed in versions 4.9.4 and 5.4.4.