CVE-2020-7694

uvicorn package: ANSI escape sequence injection via crafted URLs in request logging

• CVSS 7.5
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).

CVE

CVE-2020-7694

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

7.5

Published

2020-07-27

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update uvicorn to a version with a fix for ASNI escape sequence injection vulnerability.

import uvicorn
from fastapi import FastAPI, Request

app = FastAPI()

@app.middleware("http")
async def log_requests(request: Request, call_next):
    response = await call_next(request)
    print(f"Request: {request.url.path} - Status: {response.status_code}")
    return response

if __name__ == "__main__":
    uvicorn.run(app, host="127.0.0.1", port=8000)

import uvicorn
from fastapi import FastAPI, Request
import logging

app = FastAPI()

class AnsiEscapeFilter(logging.Filter):
    def filter(self, record):
        record.msg = self.remove_ansi_escape_sequences(record.msg)
        return True

    @staticmethod
    def remove_ansi_escape_sequences(text):
        return ''.join(c for c in text if c not in ('\x1b', '[', 'm', 'K', 'G', 'J'))

logger = logging.getLogger("uvicorn.access")
logger.addFilter(AnsiEscapeFilter())

@app.middleware("http")
async def log_requests(request: Request, call_next):
    response = await call_next(request)
    logger.info(f"Request: {request.url.path} - Status: {response.status_code}")
    return response

if __name__ == "__main__":
    uvicorn.run(app, host="127.0.0.1", port=8000)

@misc{vaitp:cve20207694,
  title        = {{uvicorn package: ANSI escape sequence injection via crafted URLs in request logging}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-7694},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-7694/}}
}