Request Smuggling Vulnerability in Waitress Package
Summary
CVE-2019-16792: Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Affects waitress across 2 version ranges.
< 1.4.1-1
< 575994cd42e83fd772a5f7ec98b2c56751bd3f65
Fixed in 1.4.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Waitress is a pure-Python WSGI server that is designed to be simple and lightweight, making it suitable for serving web applications. It is known for its ease of use and compatibility with various frameworks. However, certain versions of Waitress are vulnerable to a request smuggling issue, which can lead to significant security risks if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2019-16792, arises from the handling of the Content-Length header in HTTP requests. Specifically, Waitress versions prior to 1.4.0 allow an attacker to send two Content-Length headers in a single request. This results in header folding, where the server misinterprets the headers and sets the Content-Length to 0. Consequently, Waitress treats the request as having no body, which can lead to the body being interpreted as a new request in HTTP pipelining. This flaw can be exploited to perform request smuggling attacks, potentially allowing an attacker to bypass security controls and manipulate server responses.
How To Fix
Minimum fixed version
1.4.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade waitressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation to ensure that only a single Content-Length header is processed. However, this is not a complete solution and upgrading to the fixed version is strongly recommended.
Conclusion
The CVE-2019-16792 vulnerability in the Waitress package poses a significant security risk due to improper handling of HTTP headers. Users are strongly advised to upgrade to version 1.4.1 or later to protect their applications from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for waitress →
FAQ
CVE-2019-16792 is a vulnerability in the Waitress package that allows for request smuggling due to improper handling of multiple Content-Length headers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to request smuggling attacks, allowing attackers to bypass security measures and manipulate server responses.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
While input validation can serve as a temporary workaround, the only reliable solution is to upgrade to Waitress version 1.4.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
