First published: Tue Nov 14 2023(Updated: )
### Impact Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-Length(CL) and Transfer-Encoding(TE) it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation. A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. I can give a Dockerfile with the configuration if you want. The impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect (just like CVE-2021-21330) we can combine it to redirect random users to our website and log the request. ### References - https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371
|Affected Software||Affected Version||How to fix|
The severity of GHSA-xx9p-xxvh-7g8j is low with a severity value of 3.4.
GHSA-xx9p-xxvh-7g8j can lead to incorrect interpretation of two entities that parse the HTTP.
GHSA-xx9p-xxvh-7g8j affects Aiohttp by introducing a security vulnerability regarding the inconsistent interpretation of the http protocol.
The remedy for GHSA-xx9p-xxvh-7g8j is to upgrade to version 3.8.0 of Aiohttp.
The CWE ID of GHSA-xx9p-xxvh-7g8j is 444.