VAITP Dataset

← Back to the dataset

CVE-2020-7658

Meinheld (prior to 1.0.2) vulnerable to HTTP Request Smuggling via incorrect parsing of headers

  • CVSS 6.1
  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
  • Input Validation and Sanitization
  • Remote

meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.

CVE
CVE-2020-7658
CWE
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVSS base score
6.1
Published
2020-05-22
OWASP
A06 Vulnerable and Outdated Components
Orthogonal defect classification
Function
Code defect classification
Incorrect Functionality
Category
Input Validation and Sanitization
Subcategory
Insecure Parsing or Deserialization
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Fixed by upgrading
Yes

Solution

Update Meinheld to version 1.0.2 or higher.

Vulnerable code sample

from http.server import BaseHTTPRequestHandler, HTTPServer

class RequestHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        content_length = self.headers.get('Content-Length')
        transfer_encoding = self.headers.get('Transfer-Encoding')

        if transfer_encoding and transfer_encoding.lower() == 'chunked':
            self.handle_chunked_request()
        elif content_length is not None:
            self.handle_content_length_request(int(content_length))
        else:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b'Bad Request: Missing Content-Length or Transfer-Encoding')

    def handle_chunked_request(self):
        pass

    def handle_content_length_request(self, content_length):
        pass

def run(server_class=HTTPServer, handler_class=RequestHandler, port=8000):
    server_address = ('', port)
    httpd = server_class(server_address, handler_class)
    httpd.serve_forever()

if __name__ == "__main__":
    run()

Patched code sample

from http.server import BaseHTTPRequestHandler, HTTPServer
import sys

MAX_CONTENT_LENGTH = 1024 * 1024

class RequestHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        content_length = self.headers.get('Content-Length')
        transfer_encoding = self.headers.get('Transfer-Encoding')

        try:
            if transfer_encoding and transfer_encoding.lower() == 'chunked':
                self.handle_chunked_request()
            elif content_length is not None:
                self.handle_content_length_request(int(content_length))
            else:
                self.send_response(400)
                self.end_headers()
                self.wfile.write(b'Bad Request: Missing Content-Length or Transfer-Encoding')
        except Exception as e:
            self.send_response(500)
            self.end_headers()
            self.wfile.write(f"Internal Server Error: {str(e)}".encode())

    def handle_chunked_request(self):
        try:
            content = b""
            while True:
                chunk_size = int(self.rfile.readline(), 16)
                if chunk_size == 0:
                    break
                chunk = self.rfile.read(chunk_size)
                content += chunk
                self.rfile.readline()

            if len(content) > MAX_CONTENT_LENGTH:
                self.send_response(413)
                self.end_headers()
                self.wfile.write(b'Payload Too Large')
            else:
                self.process_data(content)
        except ValueError:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b'Bad Request: Invalid Chunk Size')

    def handle_content_length_request(self, content_length):
        if content_length > MAX_CONTENT_LENGTH:
            self.send_response(413)
            self.end_headers()
            self.wfile.write(b'Payload Too Large')
            return

        body = self.rfile.read(content_length)
        self.process_data(body)

    def process_data(self, data):
        if not self.is_safe_data(data):
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b'Bad Request: Malicious data detected')
            return

        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'OK')

    def is_safe_data(self, data):
        if b'<script>' in data or b'<?php' in data:
            return False
        return True

def run(server_class=HTTPServer, handler_class=RequestHandler, port=8000):
    server_address = ('', port)
    httpd = server_class(server_address, handler_class)
    httpd.timeout = 60
    httpd.serve_forever()

if __name__ == "__main__":
    run()

Cite this entry

@misc{vaitp:cve20207658,
  title        = {{Meinheld (prior to 1.0.2) vulnerable to HTTP Request Smuggling via incorrect parsing of headers}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-7658},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-7658/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::