CVE-2024-41671

Twisted framework allows out-of-order HTTP requests, risking information disclosure.

• CVSS 8.3
• CWE-444
• Information Leakage
• Remote

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.

CVE

CVE-2024-41671

CWE

CWE-444

CVSS base score

8.3

Published

2024-07-29

OWASP

A03 Sensitive Data Exposure

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Twisted

Fixed by upgrading

Yes

Solution

Upgrade to Twisted version 24.7.0rc1 or later.

from twisted.web import server, resource
from twisted.internet import reactor

class Simple(resource.Resource):
    isLeaf = True

    def render_GET(self, request):
        return b"Response to GET request"

site = server.Site(Simple())
reactor.listenTCP(8080, site)
reactor.run()

from twisted.web import server, resource
from twisted.internet import reactor
from twisted.python import log
import sys

class Simple(resource.Resource):
    isLeaf = True

    def render_GET(self, request):
        log.msg(f"GET request received from {request.getClientAddress()} with path: {request.path.decode()}")
        
        if not request.path.isascii() or '..' in request.path.decode():
            log.err(f"Invalid path: {request.path.decode()}")
            return b"400 Bad Request: Invalid Path"

        return b"Response to GET request"

log.startLogging(sys.stdout)

site = server.Site(Simple())

try:
    reactor.listenTCP(8080, site)
    log.msg("Server started on port 8080")
    reactor.run()
except Exception as e:
    log.err(f"Failed to start the server: {e}")

GET /secret1 HTTP/1.1
Host: vulnerable-server.com

GET /secret2 HTTP/1.1
Host: vulnerable-server.com

@misc{vaitp:cve202441671,
  title        = {{Twisted framework allows out-of-order HTTP requests, risking information disclosure.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-41671},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-41671/}}
}