CVE-2019-12387
Twisted web < 19.2.1, no URI/HTTP validation, CRLF injection
- CVSS 6.1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Input Validation and Sanitization
- Remote
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
- CVSS base score
- 6.1
- Published
- 2019-06-10
- OWASP
- A06 Vulnerable and Outdated Components
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Fixed by upgrading
- Yes
Solution
Update Twisted to version 19.2.1 or higher.
Vulnerable code sample
from twisted.web import server, resource
class MyResource(resource.Resource):
isLeaf = True
def render(self, request):
return b"Hello, world!"
site = server.Site(MyResource())
from twisted.internet import reactor
reactor.listenTCP(8080, site)
reactor.run()Patched code sample
from twisted.web import server, resource
from twisted.web.http import Request
class MyResource(resource.Resource):
isLeaf = True
def render(self, request: Request):
if not self.is_valid_uri(request.uri):
request.setResponseCode(400)
return b"Invalid URI"
if not self.is_valid_method(request.method):
request.setResponseCode(405)
return b"Method Not Allowed"
return b"Hello, world!"
def is_valid_uri(self, uri):
return all(ord(c) >= 32 and ord(c) < 127 for c in uri) and "\r" not in uri and "\n" not in uri
def is_valid_method(self, method):
return method in [b'GET', b'POST', b'PUT', b'DELETE']
site = server.Site(MyResource())
from twisted.internet import reactor
reactor.listenTCP(8080, site)
reactor.run()Cite this entry
@misc{vaitp:cve201912387,
title = {{Twisted web < 19.2.1, no URI/HTTP validation, CRLF injection}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2019},
note = {VAITP Python Vulnerability Dataset, entry CVE-2019-12387},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-12387/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::