Web Cache Poisoning Vulnerability in Python Bottle Package
Summary
CVE-2020-28473: The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. Affects python-bottle across 2 version ranges.
< 0.12.19-1
< 152219818378926f20a5ee3d339118d7cf50a8f6
Fixed in 0.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Bottle package is a lightweight WSGI micro web framework for Python, designed for building simple web applications. It is known for its minimalistic approach, allowing developers to create web applications quickly and efficiently. However, versions prior to 0.12.19 are susceptible to a web cache poisoning vulnerability, which can lead to serious security issues if exploited.
Vulnerability Detail
The vulnerability arises from the use of parameter cloaking, where an attacker can manipulate query parameters using a semicolon (;). This causes a discrepancy in how the request is interpreted by the proxy server and the actual application server. The proxy, configured with default settings, may ignore the semicolon as a separator, leading to malicious requests being cached as safe ones. This can result in unauthorized access or data exposure, as the cached responses may be served to legitimate users.
How To Fix
Minimum fixed version
0.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bottleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using semicolons in query parameters until the package is updated. Additionally, consider configuring your proxy server to handle query parameters more securely, ensuring that it does not cache requests with unkeyed parameters.
Conclusion
The Python Bottle package has a critical vulnerability related to web cache poisoning, affecting versions prior to 0.12.19. It is essential for developers using this package to upgrade to the latest version to mitigate potential security risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-bottle →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a medium severity level.
All versions of Python Bottle prior to 0.12.19 are affected by this vulnerability.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup. Visit Vulert Scanner for more details.
Exploitation of this vulnerability can lead to web cache poisoning, where malicious requests are cached and served to legitimate users, potentially exposing sensitive data or allowing unauthorized access.
Yes, the permanent fix is to upgrade to Python Bottle version 0.12.19 or later, which addresses the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python-bottle.
