CVE-2020-7695

Uvicorn <0.11.7 vulnerable to HTTP response splitting

• CVSS 5.3
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• Input Validation and Sanitization
• Remote

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

CVE

CVE-2020-7695

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS base score

5.3

Published

2020-07-27

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Uvicorn to version 0.11.7 or higher.

from fastapi import FastAPI, Response

app = FastAPI()

@app.get("/")
async def read_root():
    return {"message": "Hello World"}

@app.get("/set-header/")
async def set_header(custom_header: str):
    return Response(content="Header set", headers={"X-Custom-Header": custom_header})

from fastapi import FastAPI, Response
from starlette.middleware.cors import CORSMiddleware

app = FastAPI()

@app.middleware("http")
async def escape_crlf_headers(request, call_next):
    response = await call_next(request)
    for header in response.headers.keys():
        response.headers[header] = response.headers[header].replace('\r', '%0D').replace('\n', '%0A')
    return response

@app.get("/")
async def read_root():
    return {"message": "Hello World"}

@app.get("/set-header/")
async def set_header(custom_header: str):
    safe_header_value = custom_header.replace('\r', '').replace('\n', '')
    return Response(content="Header set", headers={"X-Custom-Header": safe_header_value})

@misc{vaitp:cve20207695,
  title        = {{Uvicorn <0.11.7 vulnerable to HTTP response splitting}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-7695},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-7695/}}
}