CVE-2024-52875: gfi kerio_control HTTP Request/Response Splitting

Vulnerability summary

CVE-2024-52875 is a high (CVSS 8.8) HTTP Request/Response Splitting vulnerability in gfi kerio_control. EPSS estimates a 29.34% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 31-01-2025
   PublishedVulnerability first disclosed.
2. 12-02-2025
   Last modifiedVulnerability information updated.

Description

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.

• CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.