aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.05775.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Aio-libs Project
  • Aiohttp
Aiohttp
  • Aiohttp
Redhat
  • Rhui
  • Satellite
  • Satellite Capsule

Configuration 1 [-]

cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Satellite 6.15 for RHEL 8
python-aiohttp-0:3.9.2-1.el8pc cpe:/a:redhat:satellite:6.15::el8 RHSA-2024:2010 2024-04-23T00:00:00Z
python-aiohttp-0:3.9.2-1.el8pc cpe:/a:redhat:satellite_capsule:6.15::el8 RHSA-2024:2010 2024-04-23T00:00:00Z
RHUI 4 for RHEL 8
python-aiohttp-0:3.9.2-1.el8ui cpe:/a:redhat:rhui:4::el8 RHSA-2024:1878 2024-04-18T00:00:00Z

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-0003 ### Impact\n\naiohttp v3.8.4 and earlier are [bundled with llhttp v6.0.6](https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules) which is vulnerable to CVE-2023-30589. The vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel.\n\nThis vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`).\n\n### Reproducer\n\n```python\nfrom aiohttp import web\n\nasync def example(request: web.Request):\n headers = dict(request.headers)\n body = await request.content.read()\n return web.Response(text=f\"headers: {headers} body: {body}\")\n\napp = web.Application()\napp.add_routes([web.post('/', example)])\nweb.run_app(app)\n```\n\nSending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling.\n\n```console\n$ printf \"POST / HTTP/1.1\\r\\nHost: localhost:8080\\r\\nX-Abc: \\rxTransfer-Encoding: chunked\\r\\n\\r\\n1\\r\\nA\\r\\n0\\r\\n\\r\\n\" \\\n | nc localhost 8080\n\nExpected output:\n headers: {'Host': 'localhost:8080', 'X-Abc': '\\rxTransfer-Encoding: chunked'} body: b''\n\nActual output (note that 'Transfer-Encoding: chunked' is an HTTP header now and body is treated differently)\n headers: {'Host': 'localhost:8080', 'X-Abc': '', 'Transfer-Encoding': 'chunked'} body: b'A'\n```\n\n### Patches\n\nUpgrade to the latest version of aiohttp to resolve this vulnerability. It has been fixed in v3.8.5: [`pip install aiohttp >= 3.8.5`](https://pypi.org/project/aiohttp/3.8.5/)\n\n### Workarounds\n\nIf you aren't able to upgrade you can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable to request smuggling:\n\n```console\n$ python -m pip uninstall --yes aiohttp\n$ AIOHTTP_NO_EXTENSIONS=1 python -m pip install --no-binary=aiohttp --no-cache aiohttp\n```\n\n### References\n\n* https://nvd.nist.gov/vuln/detail/CVE-2023-30589\n* https://hackerone.com/reports/2001873\n
Github GHSA Github GHSA GHSA-45c4-8wx5-qw6w aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules cve-icon cve-icon
https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40 cve-icon cve-icon
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w cve-icon cve-icon cve-icon
https://hackerone.com/reports/2001873 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-37276 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-37276 cve-icon
History

Fri, 18 Oct 2024 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Aio-libs Project
Aio-libs Project aiohttp
CPEs cpe:2.3:a:aio-libs_project:aiohttp:*:*:*:*:*:*:*:*
Vendors & Products Aio-libs Project
Aio-libs Project aiohttp
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-10-18T17:14:03.863Z

Reserved: 2023-06-29T19:35:26.440Z

Link: CVE-2023-37276

cve-icon Vulnrichment

Updated: 2024-08-02T17:09:34.028Z

cve-icon NVD

Status : Modified

Published: 2023-07-19T20:15:10.603

Modified: 2024-11-21T08:11:22.570

Link: CVE-2023-37276

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-07-19T00:00:00Z

Links: CVE-2023-37276 - Bugzilla

cve-icon OpenCVE Enrichment

No data.