CVE-2023-49081

Asynchronous HTTP request manipulation in aiohttp 3.8.0

• CVSS 5.3
• CWE-20 Improper Input Validation
• Information Leakage
• Remote

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

CVE

CVE-2023-49081

CWE

CWE-20 Improper Input Validation

CVSS base score

5.3

Published

2023-11-30

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Upgrade aiohttp to version 3.9.0 or newer

import aiohttp
from aiohttp import web

async def handle(request):
    return web.Response(text="Request processed")

app = web.Application()
app.router.add_get('/', handle)

if __name__ == '__main__':
    web.run_app(app)

import aiohttp
from aiohttp import web

async def handle(request):
    if request.version not in (aiohttp.HttpVersion11, aiohttp.HttpVersion10):
        return web.Response(text="Invalid HTTP version", status=400)

    return web.Response(text="Request processed safely")

app = web.Application()
app.router.add_get('/', handle)

if __name__ == '__main__':
    web.run_app(app)

@misc{vaitp:cve202349081,
  title        = {{Asynchronous HTTP request manipulation in aiohttp 3.8.0}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-49081},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-49081/}}
}