CVE-2020-28473: HTTP Request smuggling in bottle
Summary
CVE-2020-28473: bottle HTTP Request smuggling. Affects bottle versions < 0.12.19. Fixed in 0.12.19. How to fix ↓
Also tracked for
- python-bottle · Debian:11
The same CVE-2020-28473 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bottle is a Python web framework that is lightweight and easy to use. It is designed for building small web applications and APIs. The package bottle is vulnerable to Web Cache Poisoning through a technique called parameter cloaking. This vulnerability allows an attacker to manipulate query parameters using a semicolon (;) to create a difference in interpretation between the proxy and the server. By exploiting this, the attacker can trick the proxy into caching malicious requests as safe ones, leading to potential security risks.
Vulnerability Detail
The vulnerability in bottle arises from the way it handles query parameters. When a semicolon (;) is used to separate query parameters, the proxy and server interpret the request differently. The proxy, by default, does not consider the semicolon as a separator and does not include it in the cache key. This discrepancy allows an attacker to craft malicious requests that are cached as safe requests by the proxy. As a result, the server may serve cached malicious content to unsuspecting users, leading to various attacks such as web cache poisoning.
How To Fix
Minimum fixed version
0.12.19
This is the first release that contains the fix.
pip install --upgrade "bottle==0.12.19"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a possible workaround is to configure the proxy to treat semicolons as separators for query parameters. This can be done by modifying the proxy's configuration to include semicolons in the cache key calculation. However, it is strongly advised to update to the latest version of the bottle package as soon as possible.
Conclusion
The bottle package prior to version 0.12.19 is vulnerable to HTTP Request smuggling through parameter cloaking. This can lead to web cache poisoning and the serving of malicious content to users. It is crucial to update the package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bottle →
FAQ
The vulnerability allows an attacker to manipulate query parameters and potentially poison the web cache. This can lead to the serving of malicious content to users, compromising their security and privacy.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the vulnerability promptly to mitigate any potential risks.
Apart from updating the bottle package, it is advisable to implement secure caching practices and regularly monitor for any suspicious activity or unexpected behavior in the web cache.
You can refer to the GitHub advisory database for more details on this vulnerability. The link to the specific advisory is provided in the 'affected' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for bottle.
