Denial of Service in SimpleHTTPServer and BaseHTTPServer

[RichardClifford]

BPO	26005
Nosy	@brettcannon, @orsenthil, @vstinner, @ethanfurman, @vadmium, @miss-islington
PRs	bpo-34576 warn users on security for http.server #9720 [3.6] bpo-34576 warn users on security for http.server (GH-9720) #9794 [3.7] bpo-34576 warn users on security for http.server (GH-9720) #9795
Superseder	bpo-34576: [EASY doc] http.server, SimpleHTTPServer: warn users on security
Files	basehttpdos.c: SimpleHTTPServer Dos POC

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2018-10-04.21:20:11.755>
created_at = <Date 2016-01-04.08:54:10.551>
labels = ['type-feature', '3.7', 'docs']
title = 'Denial of Service in SimpleHTTPServer and BaseHTTPServer'
updated_at = <Date 2018-10-11.03:55:37.889>
user = 'https://bugs.python.org/RichardClifford'

bugs.python.org fields:

activity = <Date 2018-10-11.03:55:37.889>
actor = 'miss-islington'
assignee = 'docs@python'
closed = True
closed_date = <Date 2018-10-04.21:20:11.755>
closer = 'martin.panter'
components = ['Documentation']
creation = <Date 2016-01-04.08:54:10.551>
creator = 'Richard Clifford'
dependencies = []
files = ['41490']
hgrepos = []
issue_num = 26005
keywords = []
message_count = 9.0
messages = ['257446', '257447', '257448', '257474', '257517', '327087', '327505', '327510', '327513']
nosy_count = 8.0
nosy_names = ['brett.cannon', 'orsenthil', 'vstinner', 'docs@python', 'ethan.furman', 'martin.panter', 'Richard Clifford', 'miss-islington']
pr_nums = ['9720', '9794', '9795']
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '34576'
type = 'enhancement'
url = 'https://bugs.python.org/issue26005'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7']

[RichardClifford]

The issue comes when there is a malformed HTTP request not ending in a new line, it causes the server to hang, not timeout and causes a DoS.

The request that I sent to the server was as follows:
const char *headers = "GET / HTTP/1.1\r\nHost: localhost:8000\r\n";

Which should have been:
const char *headers = "GET / HTTP/1.1\r\nHost: localhost:8000\r\n\r\n";

This causes a the application to await the second set of new-line sequences and hang until they are received which prevents any further connections from being made.

I have just tested this against the latest versions of the library and I can supply a proof of concept code if that would be useful - just let me know.

A recommended fix would be to ensure that all HTTP requests are received in full and in the correct manor prior to being parsed.

[vadmium]

I expect the server _is_ waiting for the end of the headers before handling the response. The problem is if you do not send the blank line, the server cannot know if you have ended the headers or if there are more to come.

Perhaps you could set a socket timeout in the server. But an attacker could still send little bits of the header very slowly (called Slow Loris attack or something I think). I think a server robust against that sort of stuff would be out of scope for SimpleHTTPServer.

[vstinner]

"I think a server robust against that sort of stuff would be out of scope for SimpleHTTPServer."

We can probably enhance SimpleHTTPServer but I agree that the server should remain simple. Maybe we should be more explicit in the documentation that the server requires to trust users?

[brettcannon]

A warning directive at the start of http.server about needing to trust users would work?

[orsenthil]

SimpleHTTPServer is never meant to be used in production.

I was of the understanding that we already inform users about it in the documentation, but I do not find any such note. Only in wsgiref's simple_server.py example, we state that in the module header
https://hg.python.org/cpython/file/tip/Lib/wsgiref/simple_server.py#l1

For SimpleHTTPServer, we could add a similar warning in docs.

"SimpleHTTPServer is meant for demo purposes and does not implement the stringent security checks needed of real HTTP server. We do not recommend using this module directly in production."

If an alternate wording is desired, please suggest in that in comments.

[vadmium]

bpo-34576 was recently opened about adding a security warning.