[security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method

[maxpl0it]

BPO	39603
Nosy	@gvanrossum, @orsenthil, @vstinner, @larryhastings, @tiran, @ned-deily, @ambv, @miss-islington, @tirkarthi, @kmaork, @amiremohamadi, @maxpl0it
PRs	bpo-39603: Prevent header injection in http methods #18480 bpo-39603: Prevent header injection in http methods #18485 [3.9] bpo-39603: Prevent header injection in http methods (GH-18485) #21536 [3.8] bpo-39603: Prevent header injection in http methods (GH-18485) #21537 [3.7] bpo-39603: Prevent header injection in http methods (GH-18485) #21538 [3.6] bpo-39603: Prevent header injection in http methods (GH-18485) #21539 [3.5] bpo-39603: Prevent header injection in http methods (GH-18485) #21946

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2020-07-19.09:32:11.056>
created_at = <Date 2020-02-10.19:29:35.578>
labels = ['type-security', 'expert-SSL', '3.8', '3.9', '3.10', '3.7', 'library']
title = '[security][ CVE-2020-26116] http.client: HTTP Header Injection in the HTTP method'
updated_at = <Date 2020-09-28.22:42:24.882>
user = 'https://github.com/maxpl0it'

bugs.python.org fields:

activity = <Date 2020-09-28.22:42:24.882>
actor = 'vstinner'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2020-07-19.09:32:11.056>
closer = 'ned.deily'
components = ['Library (Lib)', 'SSL']
creation = <Date 2020-02-10.19:29:35.578>
creator = 'maxpl0it'
dependencies = []
files = []
hgrepos = []
issue_num = 39603
keywords = ['patch']
message_count = 21.0
messages = ['361710', '361808', '361818', '361828', '361865', '361896', '362239', '373915', '373916', '373917', '373918', '373944', '373945', '373946', '374020', '374093', '374095', '376335', '377586', '377607', '377643']
nosy_count = 14.0
nosy_names = ['gvanrossum', 'orsenthil', 'vstinner', 'larry', 'christian.heimes', 'ned.deily', 'lukasz.langa', 'miss-islington', 'xtreak', 'kmaork', 'Amir', 'maxpl0it', 'M W2', 'mcascella']
pr_nums = ['18480', '18485', '21536', '21537', '21538', '21539', '21946']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue39603'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

[maxpl0it]

I recently came across a bug during a pentest that's allowed me to perform some really interesting attacks on a target. While originally discovered in requests, I had been forwarded to one of the urllib3 developers after agreeing that fixing it at it's lowest level would be preferable. I was informed that the vulnerability is also present in http.client and that I should report it here as well.

The 'method' parameter is not filtered to prevent the injection from altering the entire request.

For example:
>>> conn = http.client.HTTPConnection("localhost", 80)
>>> conn.request(method="GET / HTTP/1.1\r\nHost: abc\r\nRemainder:", url="/index.html")

This will result in the following request being generated:
GET / HTTP/1.1
Host: abc
Remainder: /index.html HTTP/1.1
Host: localhost
Accept-Encoding: identity

This was originally found in an HTTP proxy that was utilising Requests. It allowed me to manipulate the original path to access different files from an internal server since the developers had assumed that the method would filter out non-standard HTTP methods.

The recommended solution is to only allow the standard HTTP methods of GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, and PATCH.

An alternate solution that would allow programmers to use non-standard methods would be to only support characters [a-z] and stop reading at any special characters (especially newlines and spaces).

[vstinner]

The recommended solution is to only allow the standard HTTP methods of GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, and PATCH.

I don't think that we have to be so strict. We can maybe restrict the HTTP method to ASCII letters, or just reject control characters (U+0000-U+001f).

Similar issues (fixed):

• https://python-security.readthedocs.io/vuln/http-header-injection2.html
• https://python-security.readthedocs.io/vuln/http-header-injection.html

[maxpl0it]

I agree that the solution is quite restrictive.
Restricting to ASCII characters alone would certainly work.