Impact

Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-Length(CL) and Transfer-Encoding(TE) it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation.

A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. I can give a Dockerfile with the configuration if you want.

The impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect (just like CVE-2021-21330) we can combine it to redirect random users to our website and log the request.

References

- https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371

aio-libs aiohttp-session contains a Session Fixation vulnerability in loadsession function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttpsession/redisstorage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).

Impact

Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.

It is caused by a bug in the aiohttp.webmiddlewares.normalizepathmiddleware middleware.

Patches

This security problem has been fixed in v3.7.4. Upgrade your dependency as follows: [pip install aiohttp >= 3.7.4]

Workarounds

If upgrading is not an option for you, a workaround can be to avoid using aiohttp.webmiddlewares.normalizepathmiddleware in your applications.

References

[aiohttp @ PyPI] [GHSA-v6wp-4m6f-gcjg] [OWASP page on open redirects]

For more information

If you have any questions or comments about this advisory: Open an issue in the aiohttp repo Email us at wk+aio-libs-security@sydorenko.org.ua and/or andrew.svetlov+aio-libs-security@gmail.com

Credit: [Jelmer Vernooij] and [Beast Glatisant].

[aiohttp @ PyPI]: https://pypi.org/p/aiohttp [pip install aiohttp >= 3.7.4]: https://pypi.org/project/aiohttp/3.7.4/ [GHSA-v6wp-4m6f-gcjg]: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg [OWASP page on open redirects]: https://cheatsheetseries.owasp.org/cheatsheets/UnvalidatedRedirectsandForwardsCheatSheet.html

[Jelmer Vernooij]: https://jelmer.uk [Beast Glatisant]: https://github.com/g147

DISPUTED AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application.