[security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method #83784

maxpl0it · 2020-02-10T19:29:36Z

BPO	39603
Nosy	@gvanrossum, @orsenthil, @vstinner, @larryhastings, @tiran, @ned-deily, @ambv, @miss-islington, @tirkarthi, @kmaork, @amiremohamadi, @maxpl0it
PRs	bpo-39603: Prevent header injection in http methods #18480 bpo-39603: Prevent header injection in http methods #18485 [3.9] bpo-39603: Prevent header injection in http methods (GH-18485) #21536 [3.8] bpo-39603: Prevent header injection in http methods (GH-18485) #21537 [3.7] bpo-39603: Prevent header injection in http methods (GH-18485) #21538 [3.6] bpo-39603: Prevent header injection in http methods (GH-18485) #21539 [3.5] bpo-39603: Prevent header injection in http methods (GH-18485) #21946

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2020-07-19.09:32:11.056>
created_at = <Date 2020-02-10.19:29:35.578>
labels = ['type-security', 'expert-SSL', '3.8', '3.9', '3.10', '3.7', 'library']
title = '[security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method'
updated_at = <Date 2020-09-28.22:42:24.882>
user = 'https://github.com/maxpl0it'

bugs.python.org fields:

activity = <Date 2020-09-28.22:42:24.882>
actor = 'vstinner'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2020-07-19.09:32:11.056>
closer = 'ned.deily'
components = ['Library (Lib)', 'SSL']
creation = <Date 2020-02-10.19:29:35.578>
creator = 'maxpl0it'
dependencies = []
files = []
hgrepos = []
issue_num = 39603
keywords = ['patch']
message_count = 21.0
messages = ['361710', '361808', '361818', '361828', '361865', '361896', '362239', '373915', '373916', '373917', '373918', '373944', '373945', '373946', '374020', '374093', '374095', '376335', '377586', '377607', '377643']
nosy_count = 14.0
nosy_names = ['gvanrossum', 'orsenthil', 'vstinner', 'larry', 'christian.heimes', 'ned.deily', 'lukasz.langa', 'miss-islington', 'xtreak', 'kmaork', 'Amir', 'maxpl0it', 'M W2', 'mcascella']
pr_nums = ['18480', '18485', '21536', '21537', '21538', '21539', '21946']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue39603'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

maxpl0it · 2020-02-10T19:29:35Z

I recently came across a bug during a pentest that's allowed me to perform some really interesting attacks on a target. While originally discovered in requests, I had been forwarded to one of the urllib3 developers after agreeing that fixing it at it's lowest level would be preferable. I was informed that the vulnerability is also present in http.client and that I should report it here as well.

The 'method' parameter is not filtered to prevent the injection from altering the entire request.

For example:
>>> conn = http.client.HTTPConnection("localhost", 80)
>>> conn.request(method="GET / HTTP/1.1\r\nHost: abc\r\nRemainder:", url="/index.html")

This will result in the following request being generated:
GET / HTTP/1.1
Host: abc
Remainder: /index.html HTTP/1.1
Host: localhost
Accept-Encoding: identity

This was originally found in an HTTP proxy that was utilising Requests. It allowed me to manipulate the original path to access different files from an internal server since the developers had assumed that the method would filter out non-standard HTTP methods.

The recommended solution is to only allow the standard HTTP methods of GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, and PATCH.

An alternate solution that would allow programmers to use non-standard methods would be to only support characters [a-z] and stop reading at any special characters (especially newlines and spaces).

vstinner · 2020-02-11T12:29:20Z

The recommended solution is to only allow the standard HTTP methods of GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, and PATCH.

I don't think that we have to be so strict. We can maybe restrict the HTTP method to ASCII letters, or just reject control characters (U+0000-U+001f).

Similar issues (fixed):

maxpl0it · 2020-02-11T14:13:39Z

I agree that the solution is quite restrictive.
Restricting to ASCII characters alone would certainly work.

amiremohamadi · 2020-02-11T18:34:30Z

can I work on it?!

amiremohamadi · 2020-02-12T07:09:21Z

@vstinner sorry to bother you, I have a quick question.

the request(...) method is like this:

def request(self, method, url, body=None, headers={}, *,          
            encode_chunked=False):                                
    """Send a complete request to the server."""                  
    self._send_request(method, url, body, headers, encode_chunked)

'request' calls '_send_request' method and '_send_request' calls 'putrequest' inside itself.

So is it good if I encode 'method' parameter to ASCII inside 'putrequest'??!

orsenthil · 2020-02-12T14:35:43Z

Welcome to work on the patch, Amir.

We shouldn't be encoding anything.
Create reject for Unicode control characters and reject the request if the request contains any control character. Write tests for this.

It will similar to one of the examples Victor has shared.

kmaork · 2020-02-18T23:17:06Z

Hey, it's been a week since the last activity here...
Amir, if you are not working on it I'd be glad to work on it as well :)

miss-islington · 2020-07-18T20:16:18Z

New changeset 8ca8a2e by AMIR in branch 'master':
bpo-39603: Prevent header injection in http methods (GH-18485)
8ca8a2e

gvanrossum · 2020-07-18T20:23:27Z

The 3.9 and 3.8 backports are waiting for tests to complete. The 3.7 and 3.6 backports need to be merged by the RM (Ned). Then someone can close this issue.

miss-islington · 2020-07-18T20:39:20Z

New changeset 668d321 by Miss Islington (bot) in branch '3.8':
bpo-39603: Prevent header injection in http methods (GH-18485)
668d321

miss-islington · 2020-07-18T20:41:59Z

New changeset 27b8110 by Miss Islington (bot) in branch '3.9':
bpo-39603: Prevent header injection in http methods (GH-18485)
27b8110

ned-deily · 2020-07-19T09:27:39Z

New changeset ca75fec by Miss Islington (bot) in branch '3.7':
bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21538)
ca75fec

ned-deily · 2020-07-19T09:28:48Z

New changeset f02de96 by Miss Islington (bot) in branch '3.6':
bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21539)
f02de96

ned-deily · 2020-07-19T09:32:11Z

Merged for release in 3.9.0b5, 3.8.5, 3.7.9, and 3.6.12. Thanks, everyone!

ambv · 2020-07-20T17:24:33Z

New changeset 580fbb0 by Łukasz Langa in branch '3.8':
Python 3.8.5
580fbb0

maxpl0it · 2020-07-22T15:33:34Z

I've just noticed an issue with the current version of the patch. It should also include 0x20 (space) since that can also be used to manipulate the request.

gvanrossum · 2020-07-22T16:01:52Z

It should also include 0x20 (space) since that can also be used to manipulate the request.

Can you indicate how to use a space in the HTTP verb as part of an attack?

larryhastings · 2020-09-04T00:54:25Z

New changeset 524b8de by Victor Stinner in branch '3.5':
bpo-39603: Prevent header injection in http methods (GH-18485) (bpo-21946)
524b8de

mcascella · 2020-09-28T07:05:14Z

Hello,

CVE-2020-26116 has been requested/assigned for this flaw via MITRE form: https://cveform.mitre.org/

I suggest mentioning it in the related vulnerability page: https://python-security.readthedocs.io/vuln/http-header-injection-method.html

Also note that httplib (python-2.7.18) seems to be affected too. Any particular reason for it not to be listed in the same vulnerability page?

Thank you,

larryhastings · 2020-09-28T16:20:01Z

Also note that httplib (python-2.7.18) seems to be affected too. Any particular reason for it not to be listed in the same vulnerability page?

Yes: 2.7 has been end-of-lifed and is no longer supported.

vstinner · 2020-09-28T22:42:25Z

Mauro Matteo Cascella: "CVE-2020-26116 has been requested/assigned for this flaw via MITRE form: https://cveform.mitre.org/ I suggest mentioning it in the related vulnerability page: https://python-security.readthedocs.io/vuln/http-header-injection-method.html"

Thanks, done.

maxpl0it mannequin added 3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes stdlib Python modules in the Lib dir type-security A security issue labels Feb 10, 2020

vstinner changed the title ~~Injection in http.client~~ [security] http.client: HTTP Header Injection in the HTTP method Feb 11, 2020

MW2 mannequin added the topic-SSL label Jul 18, 2020

MW2 mannequin assigned tiran Jul 18, 2020

MW2 mannequin added the topic-SSL label Jul 18, 2020

MW2 mannequin assigned tiran Jul 18, 2020

ned-deily added the 3.10 only security fixes label Jul 19, 2020

ned-deily closed this as completed Jul 19, 2020

ned-deily added the 3.10 only security fixes label Jul 19, 2020

ned-deily closed this as completed Jul 19, 2020

vstinner changed the title ~~[security] http.client: HTTP Header Injection in the HTTP method~~ [security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method Sep 28, 2020

ezio-melotti transferred this issue from another repository Apr 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method #83784

[security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method #83784

maxpl0it mannequin commented Feb 10, 2020

maxpl0it mannequin commented Feb 10, 2020

vstinner commented Feb 11, 2020

maxpl0it mannequin commented Feb 11, 2020

amiremohamadi mannequin commented Feb 11, 2020

amiremohamadi mannequin commented Feb 12, 2020

orsenthil commented Feb 12, 2020

kmaork mannequin commented Feb 18, 2020

miss-islington commented Jul 18, 2020

gvanrossum commented Jul 18, 2020

miss-islington commented Jul 18, 2020

miss-islington commented Jul 18, 2020

ned-deily commented Jul 19, 2020

ned-deily commented Jul 19, 2020

ned-deily commented Jul 19, 2020

ambv commented Jul 20, 2020

maxpl0it mannequin commented Jul 22, 2020

gvanrossum commented Jul 22, 2020

larryhastings commented Sep 4, 2020

mcascella mannequin commented Sep 28, 2020

larryhastings commented Sep 28, 2020

vstinner commented Sep 28, 2020

[security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method #83784

[security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method #83784

Comments

maxpl0it mannequin commented Feb 10, 2020

maxpl0it mannequin commented Feb 10, 2020

vstinner commented Feb 11, 2020

maxpl0it mannequin commented Feb 11, 2020

amiremohamadi mannequin commented Feb 11, 2020

amiremohamadi mannequin commented Feb 12, 2020

orsenthil commented Feb 12, 2020

kmaork mannequin commented Feb 18, 2020

miss-islington commented Jul 18, 2020

gvanrossum commented Jul 18, 2020

miss-islington commented Jul 18, 2020

miss-islington commented Jul 18, 2020

ned-deily commented Jul 19, 2020

ned-deily commented Jul 19, 2020

ned-deily commented Jul 19, 2020

ambv commented Jul 20, 2020

maxpl0it mannequin commented Jul 22, 2020

gvanrossum commented Jul 22, 2020

larryhastings commented Sep 4, 2020

mcascella mannequin commented Sep 28, 2020

larryhastings commented Sep 28, 2020

vstinner commented Sep 28, 2020