CVE-2024-45302: RestSharp SSRF Vulnerability

CVE-2024-45302 Overview

CVE-2024-45302 is a Carriage Return Line Feed (CRLF) injection vulnerability in RestSharp, a Simple REST and HTTP API Client for .NET. The header value argument passed to RestRequest.AddHeader, RestRequest.AddOrUpdateHeader, and RestClient.AddDefaultHeader is not validated for CRLF characters. RestSharp adds headers via HttpHeaders.TryAddWithoutValidation, which permits raw \r\n sequences in the value. Applications that forward user-controlled input into these header values become vulnerable to HTTP request splitting and Server-Side Request Forgery (SSRF). RestSharp addressed the issue in version 112.0.0.

Critical Impact
Applications using vulnerable RestSharp versions to pass user-controlled data into HTTP headers can be abused for request smuggling, header injection, and SSRF against internal services.

Affected Products

RestSharp versions prior to 112.0.0
.NET applications embedding vulnerable RestSharp releases
Web applications that forward untrusted input into RestSharp header APIs

Discovery Timeline

2024-08-29 - CVE-2024-45302 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45302

Vulnerability Analysis

RestSharp constructs outbound HTTP requests using System.Net.Http.HttpHeaders.TryAddWithoutValidation. This method intentionally skips syntactic validation of header values, including checks for CRLF characters. When an application calls AddHeader(name, value) with a value derived from user input, an attacker can embed \r\n sequences to terminate the current header and inject additional headers or an entirely new HTTP request line.

In HTTP/1.1, header boundaries are defined by CRLF sequences. Injecting \r\n\r\n allows an attacker to close the header block and append a request body or a second request. Downstream intermediaries and origin servers may parse the smuggled content as a separate request, enabling SSRF against internal endpoints.

Root Cause

The root cause is missing input validation on header values [CWE-93: Improper Neutralization of CRLF Sequences] and [CWE-74: Improper Neutralization of Special Elements in Output]. The HeaderParameter record accepted any string as a value without rejecting control characters. Because RestSharp used TryAddWithoutValidation rather than TryAddWithValidation, the .NET runtime's built-in header validation was bypassed.

Attack Vector

Exploitation requires that a downstream application pass attacker-controlled data unfiltered into a RestSharp header API. The attacker supplies a value containing \r\n followed by an injected header or request line. RestSharp serializes the value verbatim into the outbound HTTP stream, allowing header injection or request splitting against the target service.

csharp

// Patched code in src/RestSharp/Parameters/HeaderParameter.cs
// Source: https://github.com/restsharp/RestSharp/commit/0fba5e727d241b1867bd71efc912594075c2934b

using System.Text;
using System.Text.RegularExpressions;

namespace RestSharp;

public partial record HeaderParameter : Parameter {
    /// <summary>
    /// Instantiates a header parameter
    /// </summary>
    /// <param name="name">Header name</param>
    /// <param name="value">Header value</param>
    /// <param name="encode">Set to true to encode header value according to RFC 2047. Default is false.</param>
    public HeaderParameter(string name, string value, bool encode = false)
        : base(
            EnsureValidHeaderString(Ensure.NotEmptyString(name, nameof(name)), "name"),
            EnsureValidHeaderValue(name, value, encode),
            ParameterType.HttpHeader,
            false
        ) { }

    public new string Name  => base.Name!;
}

The patch introduces EnsureValidHeaderString and EnsureValidHeaderValue helpers that reject CRLF and other control characters before the header reaches the underlying HttpClient.

Detection Methods for CVE-2024-45302

Indicators of Compromise

Outbound HTTP requests containing unexpected additional headers or duplicate request lines within a single connection
Application logs showing header values with embedded %0d%0a, \r\n, or literal CR/LF byte sequences
Unexpected traffic from application servers to internal or metadata endpoints such as 169.254.169.254

Detection Strategies

Perform Software Composition Analysis (SCA) to inventory all .NET projects referencing RestSharp at versions below 112.0.0
Instrument code review or static analysis rules to flag calls to AddHeader, AddOrUpdateHeader, and AddDefaultHeader that receive tainted input
Deploy a Web Application Firewall (WAF) rule to reject request parameters containing raw CR/LF characters before they reach application code

Monitoring Recommendations

Log and alert on outbound HTTP requests originating from application servers to unusual internal hosts or cloud metadata services
Capture full HTTP request/response headers at egress proxies to detect request-splitting patterns
Correlate application error logs with anomalous downstream 4xx/5xx responses that may indicate malformed smuggled requests

How to Mitigate CVE-2024-45302

Immediate Actions Required

Upgrade the RestSharp NuGet package to version 112.0.0 or later across all .NET projects
Audit application code for header APIs that receive user-controlled input and add explicit CRLF filtering
Rebuild and redeploy any downstream applications that transitively depend on RestSharp

Patch Information

The fix is delivered in RestSharp 112.0.0 via commit 0fba5e7. Details are published in the GitHub Security Advisory GHSA-4rr6-2v9v-wcpc. The patch adds EnsureValidHeaderString and EnsureValidHeaderValue validators to the HeaderParameter record, rejecting header names and values containing CR, LF, or other prohibited control characters.

Workarounds

No official workarounds exist; upgrading to 112.0.0 is the only supported remediation
As interim defense, sanitize all header values in application code by stripping or rejecting \r and \n characters before invoking RestSharp APIs
Restrict egress network access from application servers to only required destinations to limit SSRF blast radius

bash

# Upgrade RestSharp via .NET CLI
dotnet add package RestSharp --version 112.0.0

# Verify installed version
dotnet list package | grep -i restsharp