Critical HTTP Request Splitting Vulnerability in Twisted Web
Summary
CVE-2020-10109: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. Affects twisted across 2 version ranges.
< 18.9.0-7
< c0a51509974e995537212efc5074140388585da6
Fixed in 18.9.0-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is an event-driven networking engine written in Python, designed to facilitate the development of networked applications. It supports various protocols and provides a robust framework for building web servers and clients. The Twisted Web module specifically handles HTTP requests and responses, making it a crucial component for web applications. The vulnerability in question affects versions up to 19.10.0, where improper handling of HTTP headers can lead to serious security issues.
Vulnerability Detail
In Twisted Web versions prior to 19.10.0, an HTTP request splitting vulnerability exists due to the mishandling of the 'Content-Length' and 'Chunked Encoding' headers. When both headers are present, the 'Content-Length' header takes precedence, causing the remainder of the request body to be interpreted as a separate pipelined request. This can lead to various attacks, including cache poisoning and cross-site scripting, as attackers can manipulate the request flow and potentially execute malicious payloads.
How To Fix
Minimum fixed version
18.9.0-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade twistedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing a reverse proxy that sanitizes incoming requests, ensuring that both 'Content-Length' and 'Chunked Encoding' headers are not processed simultaneously. This can help mitigate the risk until a proper update can be applied.
Conclusion
The HTTP request splitting vulnerability in Twisted Web poses significant risks to applications utilizing this framework. It is crucial to update to the latest version to mitigate these risks and ensure the security of your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for twisted →
FAQ
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
All versions of Twisted Web up to and including 19.10.0 are affected by this vulnerability.
The vulnerability can lead to HTTP request splitting, which may result in cache poisoning, cross-site scripting, and other attacks that exploit the request handling mechanism.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Implement a reverse proxy to sanitize incoming requests as a temporary measure until you can update to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
