A critical CRLF injection vulnerability in CI4MS allows unauthenticated attackers to overwrite system configuration files, potentially leading to full system compromise.

This flaw is a CRLF injection (CWE-93) occurring in the Install::index() controller, where unsanitized input is used to update the .env configuration file. An unauthenticated attacker can trigger this by bypassing the InstallFilter during specific conditions, such as a fresh deployment or cache expiration, due to the explicit disabling of CSRF protections on install routes.

The ability to inject arbitrary directives into the .env file grants an attacker the power to alter database credentials, application keys, and other critical security settings. Given the CVSS score of 8.1, this vulnerability poses a severe risk of unauthorized access and total system compromise, which could result in significant data loss or operational downtime.

Immediate Action: Update the ci4ms package to version 0.31.4.0 or later immediately to incorporate the necessary input validation and security patches.

Proactive Monitoring: Review access logs for unusual POST requests directed at the installation routes and monitor the integrity of the .env file for unauthorized modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block CRLF sequences in POST parameters to prevent exploitation attempts until the application can be patched.

Public Exploit Available: Unknown.

Organizations utilizing CI4MS must prioritize the upgrade to version 0.31.4.0 to remediate this CRLF injection flaw. Because the vulnerability allows for the modification of environmental configuration without authentication, the risk of remote code execution or complete application takeover is high, necessitating immediate patching of all production instances.