CVE-2023-49082

aiohttp 3.9.0 allows HTTP request manipulation

• CVSS 5.3
• CWE-20 Improper Input Validation
• Information Leakage
• Remote

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.

CVE

CVE-2023-49082

CWE

CWE-20 Improper Input Validation

CVSS base score

5.3

Published

2023-11-29

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update to version 3.9.0 or later of aiohttp

from aiohttp import web

async def handle(request):
    return web.Response(text="Hello, world!")

app = web.Application()
app.router.add_route('*', '/', handle)

if __name__ == '__main__':
    web.run_app(app)

from aiohttp import web

async def handle(request):
    if request.method not in ['GET', 'POST']:
        return web.Response(status=405, text="Method Not Allowed")
    
    return web.Response(text="Hello, world!")

app = web.Application()
app.router.add_route('*', '/', handle)

if __name__ == '__main__':
    web.run_app(app)

@misc{vaitp:cve202349082,
  title        = {{aiohttp 3.9.0 allows HTTP request manipulation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-49082},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-49082/}}
}