CRLF Injection in urllib2 and urllib in Python
Summary
CVE-2019-18348: An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. Affects python2 across 2 version ranges.
< 2.7.18-r0
>= 6046c5e0298c25515ea58abc8ab87f7413e3f743, < 426b022776672fdf3d71ddd98d89af341c88080f
Fixed in 2.7.18-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The urllib2 library in Python 2.x and urllib library in Python 3.x are widely used for making HTTP requests. They provide a set of functions and classes to interact with URLs and handle HTTP connections. These libraries are an integral part of the Python standard library and are used by many applications and frameworks.
Vulnerability Detail
The CRLF injection vulnerability (CVE-2019-18348) allows an attacker to inject arbitrary HTTP headers by controlling a URL parameter. This can be exploited when the attacker can manipulate the first argument to urllib.request.urlopen, specifically in the host component of a URL, by appending a CRLF sequence (\r\n) followed by an HTTP header. This vulnerability is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. However, it is not exploitable when the glibc library has CVE-2016-10739 fixed. The impact of this vulnerability can range from unauthorized information disclosure to potential remote code execution.
How To Fix
Minimum fixed version
2.7.18-r0
This is the first release that contains the fix.
sudo apk add --upgrade python2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest Python versions is not feasible, a possible workaround is to manually sanitize and validate user-controlled input before using it in URL parameters. This can involve removing any CRLF sequences and ensuring that the input adheres to the expected format. Here is an example of how to sanitize a URL parameter in Python:
import urllib.parse
def sanitize_url_param(url_param):
sanitized_param = urllib.parse.quote(url_param, safe='')
return sanitized_param
This code snippet uses the urllib.parse.quote function to sanitize the URL parameter by encoding any special characters.
Conclusion
The CRLF injection vulnerability in urllib2 and urllib (CVE-2019-18348) allows an attacker to inject arbitrary HTTP headers by controlling a URL parameter. This can lead to unauthorized information disclosure, remote code execution, and other security risks. It is crucial to update to the latest Python versions that include the fix for this vulnerability. If upgrading is not feasible, manual input sanitization and validation can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python2 →
FAQ
The impact of this vulnerability can range from unauthorized information disclosure to potential remote code execution. An attacker can inject arbitrary HTTP headers, potentially leading to various attacks such as session hijacking, cross-site scripting (XSS), or server-side request forgery (SSRF). It is crucial to patch this vulnerability to prevent these security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including the CRLF injection vulnerability in urllib2 and urllib.
Yes, if upgrading to the latest Python versions is not feasible, you can manually sanitize and validate user-controlled input before using it in URL parameters. This involves removing any CRLF sequences and ensuring that the input adheres to the expected format. Refer to the 'workaround' section for an example code snippet.
While specific exploits for this vulnerability have not been disclosed, it is important to patch the vulnerability as soon as possible to prevent potential attacks. The CRLF injection vulnerability can be leveraged by attackers to manipulate HTTP headers and potentially gain unauthorized access or perform other malicious actions.
You can find more information about the CRLF injection vulnerability (CVE-2019-18348) in the official CVE database at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348. Additionally, the Python Security Response Team has provided detailed information about this vulnerability in their advisory PSF-2019-7.
Related vulnerabilities
Recent vulnerabilities recorded for python2.
