CRLF Injection in urllib3
Summary
CVE-2020-26137: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). Affects py3-urllib3 across 2 version ranges.
< 1.25.9-r0
< 1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
Fixed in 1.25.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful HTTP client library for Python, providing a simple and intuitive interface for making HTTP requests. It is widely used in various applications and frameworks. However, urllib3 versions before 1.25.9 are vulnerable to CRLF injection if the attacker controls the HTTP request method. This vulnerability allows the attacker to insert carriage return (CR) and line feed (LF) control characters in the first argument of the putrequest() function. This can lead to various attacks, including HTTP response splitting, cache poisoning, and cross-site scripting (XSS).
Vulnerability Detail
The vulnerability (CVE-2020-26137) originates from a lack of proper input validation in urllib3. By manipulating the HTTP request method, an attacker can inject CR and LF characters into the request, potentially altering the intended behavior of the server or injecting malicious content. This can result in serious security implications, such as the ability to manipulate headers, perform XSS attacks, or poison caches. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
How To Fix
Minimum fixed version
1.25.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade py3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the input to remove any CR and LF characters before passing it to the putrequest() function. This can be achieved by using appropriate input validation and sanitization techniques, such as regular expressions or string manipulation functions. However, applying the official fix by upgrading urllib3 is the recommended approach.
Conclusion
The CRLF injection vulnerability in urllib3 (CVE-2020-26137) can have serious security implications, allowing attackers to manipulate HTTP requests and potentially compromise the integrity and security of the affected system. It is crucial for developers to upgrade urllib3 to version 1.25.9 or later to mitigate this vulnerability. Regularly monitoring for security updates and applying them promptly is essential to maintain the security of applications.
See every vulnerability recorded for py3-urllib3 →
FAQ
urllib3 is a Python library used for making HTTP requests. It provides a high-level interface for interacting with web servers and handling various aspects of the HTTP protocol.
CRLF injection is a web application vulnerability that allows an attacker to insert carriage return (CR) and line feed (LF) characters into HTTP requests or responses. This can lead to various attacks, such as HTTP response splitting, cache poisoning, and cross-site scripting (XSS).
The consequences of this vulnerability can vary depending on the specific context and application. However, possible ramifications include header manipulation, XSS attacks, cache poisoning, and potentially compromising the integrity and security of the affected system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
While specific exploits for this vulnerability have not been disclosed, the potential impact of CRLF injection vulnerabilities is well-documented. It is crucial to promptly apply the recommended fixes and stay vigilant for any signs of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for py3-urllib3.
