CVE-2024-23644: 
Rust vulnerability analysis and mitigation

Trillium, a composable toolkit for building internet applications with async rust, disclosed a vulnerability (CVE-2024-23644) affecting trillium-http prior to 0.3.12 and trillium-client prior to 0.5.4. The vulnerability was discovered by divergentdave and reported to the maintainers, with patches issued within 24 hours of acknowledgment on January 23, 2024 (Vendor Advisory).

The vulnerability stems from insufficient validation of outbound header values in both request and response handling. The trillium_http::HeaderValue and trillium_http::HeaderName could be constructed infallibly without proper validation of illegal bytes during request sending from the client or response sending from the server. This vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) by NVD with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, while GitHub assessed it at 6.8 (MEDIUM) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (NVD).

The vulnerability could allow attackers to perform request splitting or response splitting attacks if they gain sufficient control over header values or names. This could potentially lead to the client and server becoming out of sync, enabling attackers to pivot and gain control over other parts of requests or responses. The impact could include data exfiltration from other requests and Server-Side Request Forgery (SSRF) attacks (Vendor Advisory).

For trillium-http version 0.3.12 and later, invalid header names and their associated values are omitted from network transmission in server response headers. Individual invalid header values are also omitted while maintaining other valid values with the same header name. In trillium-client version 0.5.4 and later, if any header name or value is invalid in client request headers, the client returns an Error::MalformedHeader before network access. As a workaround, applications should sanitize or validate untrusted input in header values and names, ensuring carriage return, newline, and null characters are not allowed (Vendor Advisory).