CVE-2019-16792: Inconsistent Interpretation of HTTP Requests in Waitress

Background

Waitress is a Python WSGI server that serves web applications. It is designed to be simple, efficient, and reliable. Waitress accepts HTTP requests and processes them to deliver the requested content. However, versions up to 1.3.1 of Waitress are vulnerable to an inconsistency in the interpretation of HTTP requests, which can lead to request smuggling.

Vulnerability Detail

The vulnerability in Waitress arises when a request contains two Content-Length headers. Waitress incorrectly handles this situation by folding the headers and treating the value as a comma-separated list. As a result, Waitress sets the Content-Length to 0 internally, treating the request as having no body. This behavior can be exploited in HTTP pipelining, where the body of the request is treated as a new request. An attacker can manipulate the request smuggling to bypass security measures, potentially leading to unauthorized access or other malicious activities. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.

pip install --upgrade "waitress==3.0.2"

pip install --upgrade "waitress==1.4.0"

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually inspecting and validating the Content-Length header in incoming requests. By ensuring that only a single valid Content-Length header is present, the vulnerability can be mitigated. Here is an example of how to implement this workaround in Python:

import waitress

def validate_content_length(request):
    headers = request.headers
    if 'Content-Length' in headers:
        content_length = headers.get('Content-Length')
        if ',' in content_length:
            # Handle multiple Content-Length headers
            # Log or reject the request
        else:
            # Proceed with normal request handling
            pass
    else:
        # Proceed with normal request handling
        pass

waitress.serve(validate_content_length, listen='0.0.0.0:8080')

This code snippet demonstrates how to validate the Content-Length header and handle multiple headers appropriately. By rejecting or logging requests with multiple Content-Length headers, the vulnerability can be mitigated until an upgrade to the fixed version is possible.

Conclusion

In summary, Waitress versions up to 1.3.1 are vulnerable to an inconsistent interpretation of HTTP requests, which can lead to request smuggling. It is crucial to upgrade to Waitress version 1.4.0 or later to fix this vulnerability. In the meantime, a temporary workaround can be implemented by manually validating the Content-Length header. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for waitress →

FAQ