Yadhu Krishna M

The issue was addressed with improved UI handling. Visiting a website that frames malicious content may lead to UI spoofing.

The issue is related to the llhttp parser in the http module, which does not strictly use the CRLF sequence to delimit HTTP requests, leading to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser, contrary to RFC7230 section 3, which states that only the CRLF sequence should delimit each header-field.

The issue occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user, leading to a leakage of sensitive information from the server. This happens when the interceptor mode is set to proxy.

The issue concerns a lack of validation for requests in the SQL dashboard area, allowing sensitive actions to be performed without proper verification of the request's origin. This could enable an attacker to trick a user into performing unintended actions through a Cross Site Request Forgery (CSRF) attack.