CVE-2020-15693: 
Nim vulnerability analysis and mitigation

The vulnerability (CVE-2020-15693) affects Nim version 1.2.4's standard library httpClient component. The vulnerability allows for CR-LF injection in the target URL when an attacker controls any part of the URL provided to httpClient methods, user-agent, or custom HTTP header names or values (Openwall, NVD).

The vulnerability shares similarities with CVE-2019-9740 and CVE-2019-9947 reported for Python language but includes more injection vectors. The injection is possible in various components: any part of the URL provided to httpClient.[get|post|...], the user-agent, or custom HTTP header names or values. The vulnerability allows for header injection in query parameters, path components, and user-agent fields (Openwall).

An attacker who controls any part of the URL, user-agent, or HTTP headers can inject CR-LF sequences, potentially leading to HTTP request smuggling or header injection attacks. This could allow for request manipulation and potentially lead to security bypasses or unauthorized access (Consensys).

The vulnerability can be exploited by injecting CR-LF sequences in various parts of the HTTP request, including URL parameters, path components, and HTTP headers. Proof of concept code demonstrates successful exploitation through different injection vectors including query parameters, path components, and user-agent fields (Openwall).

The vulnerability was fixed in Nim version 1.2.6. Users should upgrade to this version or later to receive the security fix. The fix was released on July 30, 2020 (Nim Blog).