CVE-2020-10108: HTTP Request Splitting Vulnerability in Twisted

Background

Twisted is an event-driven networking engine written in Python. It provides a framework for building networked applications, including web servers. Twisted Web, a component of Twisted, allows developers to create web servers and clients. This vulnerability affects Twisted Web versions up to 19.10.0. The vulnerability allows an attacker to manipulate HTTP requests by presenting two content-length headers, causing the first header to be ignored and the request body to be interpreted as a pipelined request.

Vulnerability Detail

The HTTP request splitting vulnerability in Twisted Web arises when the server receives two content-length headers. The server incorrectly ignores the first header and uses the second content-length value. If the second content-length value is set to zero, the request body is interpreted as a pipelined request. This can lead to various security issues, including request smuggling, cache poisoning, and injection attacks. Attackers can exploit this vulnerability to bypass security measures, manipulate requests, and potentially gain unauthorized access to sensitive information.

pip install --upgrade "twisted==26.4.0"

pip install --upgrade "twisted==20.3.0rc1"

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement a custom request handler that validates and sanitizes incoming requests. This handler should check for and reject requests with multiple content-length headers or a content-length value of zero. Here is an example of a workaround in Python:

from twisted.web import server, resource

class CustomRequestHandler(resource.Resource):
    def render(self, request):
        if len(request.requestHeaders.getRawHeaders('content-length', [])) > 1:
            return b'400 Bad Request'
        if request.requestHeaders.getRawHeaders('content-length', [b'0'])[0] == b'0':
            return b'400 Bad Request'
        # Process the request normally
        return super().render(request)

# Create a server with the custom request handler
site = server.Site(CustomRequestHandler())

# Run the server
reactor.listenTCP(8080, site)
reactor.run()

Conclusion

The HTTP request splitting vulnerability in Twisted Web can have serious security implications, allowing attackers to manipulate requests and potentially gain unauthorized access. It is crucial to upgrade to the latest version of Twisted Web (20.3.0rc1 or later) to mitigate this vulnerability. If immediate upgrading is not possible, implementing a custom request handler can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for twisted →

FAQ