An unauthenticated attacker can exploit an HTTP response splitting vulnerability in the Dancer2 web application framework by injecting malicious CRLF sequences into header names.

The vulnerability is caused by improper neutralization of CRLF sequences in HTTP headers (CWE-113), specifically within the headers_to_array function. An unauthenticated attacker can supply crafted input that results in response splitting, allowing for the injection of arbitrary headers into the HTTP response.

The ability to perform HTTP response splitting can lead to cache poisoning, cross-site scripting (XSS), or the bypass of security filters depending on the downstream infrastructure. While the CVSS score of 6.5 reflects a Medium severity rating, the potential for manipulation of HTTP traffic poses a significant risk to the integrity of web communication and user session security.

Immediate Action: Upgrade to Dancer2 version 2.2.0 or later, which includes the necessary sanitization logic to strip CR and LF characters from header names.

Proactive Monitoring: Monitor web server logs for unusual HTTP response patterns or headers that appear malformed or contain unexpected carriage return and line feed characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block HTTP responses containing CRLF sequences in header fields to provide virtual patching until the update is applied.

Public Exploit Available: Unknown

This vulnerability represents a fundamental flaw in how the framework handles HTTP header construction. Given the ease of exploitation, organizations utilizing Dancer2 should prioritize the update to version 2.2.0 during the next maintenance cycle to ensure full compliance with HTTP standards and to prevent potential response splitting attacks.