CVE-2022-31015

Waitress 2.1.0 and 2.1.1 thread socket issue

• CVSS 5.9
• CWE-248 Uncaught Exception
• Design Defects
• Remote

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

CVE

CVE-2022-31015

CWE

CWE-248 Uncaught Exception

CVSS base score

5.9

Published

2022-05-31

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Design Defects

Subcategory

Inadequate Error Handling

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to Waitress version 2.1.2.

from waitress import serve
import socket
import threading

def app(environ, start_response):
    """Vulnerable function that demonstrates the security issue."""
    status = '200 OK'
    headers = [('Content-type', 'text/plain; charset=utf-8')]
    start_response(status, headers)
    return [b"Hello, World!"]

def close_socket(sock):
    """Vulnerable function that demonstrates the security issue."""
    # Simulate closing the socket from a thread
    sock.close()

if __name__ == '__main__':
    server = serve(app, host='0.0.0.0', port=8080)
    
    # Simulate a thread that closes the socket while the server is running
    threading.Thread(target=close_socket, args=(server.socket,)).start()

from waitress import serve
from wsgiref.simple_server import make_server

def app(environ, start_response):
    """Secure function that fixes the vulnerability."""
    status = '200 OK'
    headers = [('Content-type', 'text/plain; charset=utf-8')]
    start_response(status, headers)
    return [b"Hello, World!"]

if __name__ == '__main__':
    # Use waitress to serve the application
    serve(app, host='0.0.0.0', port=8080)

@misc{vaitp:cve202231015,
  title        = {{Waitress 2.1.0 and 2.1.1 thread socket issue}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-31015},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-31015/}}
}