CVE-2025-8154: Webhook API HTTP Header Injection Flaw

CVE-2025-8154 Overview

CVE-2025-8154 is an HTTP response header injection vulnerability affecting WSO2 Webhook API invocations. The component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization. Attackers can inject these headers into HTTP responses returned by the application.

Successful exploitation allows a remote, unauthenticated attacker to inject or overwrite arbitrary HTTP response headers. This can manipulate browser caching, alter security-related headers, and expose sensitive information including cookie values. The vulnerability maps to [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact

Attackers can manipulate HTTP response headers to enable session hijacking, cache poisoning, and bypass of security headers without requiring authentication or user interaction.

Affected Products

• WSO2 products implementing the Webhook API invocation component (see WSO2 Security Advisory WSO2-2025-4410 for the version matrix)

Discovery Timeline

• 2026-05-11 - CVE-2025-8154 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2025-8154

Vulnerability Analysis

The vulnerability resides in the Webhook API invocation logic. The component reads HTTP header values from incoming requests and reflects them into outbound HTTP responses without applying neutralization for CR (\r) and LF (\n) characters. When an attacker supplies header values containing these line terminators, the server emits them verbatim into the response stream.

Because HTTP uses CRLF sequences as header delimiters, this primitive lets attackers terminate the current header and inject additional headers of their choosing. The attack requires no privileges and no user interaction, and it is exploitable over the network.

The consequences extend beyond simple header forgery. Injected Set-Cookie headers can overwrite session cookies. Injected Cache-Control or Location headers can poison shared caches or redirect clients. Overwriting Content-Security-Policy or X-Frame-Options weakens downstream client-side protections.

Root Cause

The root cause is missing input validation on HTTP request header values that the Webhook API component subsequently writes into the response. The component fails to strip or reject CRLF sequences and other control characters classified under [CWE-74].

Attack Vector

An attacker sends a crafted HTTP request to a vulnerable webhook endpoint with malicious header values containing encoded CRLF sequences followed by attacker-controlled header content. The server processes the request, reflects the tainted value into the response, and the injected headers become part of the client-facing HTTP response. Refer to the WSO2 Security Advisory WSO2-2025-4410 for protocol-level details.

Detection Methods for CVE-2025-8154

Indicators of Compromise

• HTTP requests to webhook endpoints containing encoded CRLF sequences (%0d%0a, %0D%0A) inside header values.
• Anomalous duplicate or unexpected response headers such as repeated Set-Cookie, Location, or Content-Type entries.
• Web server access logs showing header values with embedded newline characters or non-printable control bytes.

Detection Strategies

• Inspect ingress traffic at the WAF or reverse proxy for CR/LF byte sequences within HTTP header fields.
• Compare outbound response headers against an allowlist baseline and flag deviations introduced per-request.
• Correlate webhook endpoint requests with downstream session anomalies such as unexpected cookie rotations.

Monitoring Recommendations

• Enable verbose access logging on WSO2 gateways and ship logs to a SIEM for CRLF pattern matching.
• Alert on HTTP 200 responses to webhook routes that contain more Set-Cookie headers than the application normally emits.
• Monitor for unexpected cache entries returned by upstream CDNs that originated from webhook endpoints.

How to Mitigate CVE-2025-8154

Immediate Actions Required

• Apply the fixed versions referenced in WSO2 Security Advisory WSO2-2025-4410.
• Restrict network exposure of Webhook API endpoints to trusted callers where business logic permits.
• Audit recent webhook traffic for CRLF injection attempts and rotate any session cookies that may have been overwritten.

Patch Information

WSO2 has published remediation guidance in advisory WSO2-2025-4410. Administrators should consult the advisory for the specific product versions, WUM updates, and U2 patches applicable to their deployment.

Workarounds

• Deploy a WAF rule that rejects HTTP requests containing raw or URL-encoded CR/LF characters within header values.
• Configure the reverse proxy fronting WSO2 to normalize and validate header values before forwarding to the webhook component.
• Strip or reject any inbound request headers not on a documented allowlist for webhook processing.

# Example ModSecurity rule to block CRLF in header values
SecRule REQUEST_HEADERS "@rx (?:\r|\n|%0[ad]|%0[AD])" \
  "id:1008154,phase:1,deny,status:400,\
   msg:'CVE-2025-8154 CRLF injection attempt in HTTP header'"