CVE-2024-52304: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.
Impact If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71
Other sources
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.10.11 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.10.11Patch 259edc369075de63e6f3a4eaade058c62af0df71 - Compensating control
If a pure-Python aiohttp deployment is used (no C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, apply compensating network controls to prevent request smuggling exploitation (e.g., strengthen/protect firewall or proxy protections) until aiohttp 3.10.11 is deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52304?
CVE-2024-52304 has been classified as a medium severity vulnerability due to its potential for causing request smuggling under specific conditions.
How do I fix CVE-2024-52304?
To fix CVE-2024-52304, upgrade aiohttp to version 3.10.11 or later.
What software is affected by CVE-2024-52304?
CVE-2024-52304 specifically affects aiohttp version 3.10.10 and earlier when using a pure Python installation.
What kind of vulnerabilities can CVE-2024-52304 lead to?
CVE-2024-52304 can lead to request smuggling vulnerabilities, potentially allowing attackers to bypass security measures.
Is CVE-2024-52304 reversible?
CVE-2024-52304 does not have a reversible condition, but implementing the recommended upgrade mitigates the vulnerability.