CVE-2023-49081: aiohttp's ClientSession is vulnerable to CRLF injection via version
Summary Improper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.
Details The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type). For example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the version parameter. Furthermore, the vulnerability only occurs when the Connection header is passed to the headers parameter.
At this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.
PoC The POC below shows an example of providing an unvalidated array as a version: https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e
Impact CRLF injection leading to Request Smuggling.
Workaround If these specific conditions are met and you are unable to upgrade, then validate the user input to the version parameter to ensure it is a str.
Patch: https://github.com/aio-libs/aiohttp/pull/7835/files
Other sources
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.9.0 - Upgrade
Upgrade
redhat/aiohttpto a version that resolves this vulnerability.Fixed in 3.9.0 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.9.0 - Configuration
Validate the user input to the 'version' parameter to ensure it is a str; reject arrays/lists to prevent CRLF injection and request smuggling.
aiohttp ClientSession version parameter type = str - Configuration
Do not pass the 'Connection' header via the headers parameter (ensure it is absent or sanitized); avoid passing lists as header values which can bypass validation.
aiohttp ClientSession headers[Connection] = not passed / removed
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID is CVE-2023-49081.
What is the summary of this vulnerability?
The vulnerability allows an attacker to modify the HTTP request, including inserting a new header or creating a new request if they control the HTTP version.
How does this vulnerability occur?
The vulnerability occurs due to improper validation of the HTTP request, specifically in the aiohttp package version up to 3.9.0.
How can I fix this vulnerability?
You can fix this vulnerability by upgrading the aiohttp package to version 3.9.0 or later.
Is there any additional information about this vulnerability?
Yes, you can find more information about this vulnerability in the advisory links provided.