CVE-2023-47627
AIOHTTP HTTP parser header parsing vulnerabilities in versions prior to 3.8.6 when AIOHTTP_NO_EXTENSIONS is enabled
- CVSS 7.5
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- Input Validation and Sanitization
- Remote
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.
- CVSS base score
- 7.5
- Published
- 2023-11-14
- OWASP
- A04 Insecure Design
- Orthogonal defect classification
- Checking
- Code defect classification
- Missing Check
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Unauthorized Access
- Fixed by upgrading
- Yes
Solution
Upgrade aiohttp to version 3.8.6 or newer
Vulnerable code sample
import aiohttp
from aiohttp import web
async def handle(request):
return web.Response(text="Hello, world")
app = web.Application()
app.router.add_get('/', handle)
if __name__ == '__main__':
web.run_app(app, port=8080)Patched code sample
import aiohttp
from aiohttp import web
import logging
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)
@web.middleware
async def error_middleware(request, handler):
try:
response = await handler(request)
return response
except web.HTTPException as ex:
logger.warning(f"HTTP error: {ex}")
raise
except Exception as ex:
logger.exception("Unexpected error occurred")
return web.Response(text="Internal Server Error", status=500)
@web.middleware
async def headers_middleware(request, handler):
response = await handler(request)
response.headers.update({
"X-Content-Type-Options": "nosniff",
"X-Frame-Options": "DENY",
"X-XSS-Protection": "1; mode=block",
"Content-Security-Policy": "default-src 'self'"
})
return response
async def handle(request):
return web.Response(text="Hello, world")
def create_app():
app = web.Application(middlewares=[error_middleware, headers_middleware])
app.router.add_get('/', handle)
return app
if __name__ == '__main__':
app = create_app()
web.run_app(app, port=8080)Cite this entry
@misc{vaitp:cve202347627,
title = {{AIOHTTP HTTP parser header parsing vulnerabilities in versions prior to 3.8.6 when AIOHTTP_NO_EXTENSIONS is enabled}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2023},
note = {VAITP Python Vulnerability Dataset, entry CVE-2023-47627},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-47627/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::