{"id":"GHSA-8r99-h8j2-rw64","aliases":[],"url":"https://o3.security/vulnerability/GHSA-8r99-h8j2-rw64","summary":"Twisted vulnerable to HTTP Request Smuggling Attacks","details":"### Impact\nTwisted Web is vulnerable to request smuggling attacks:\n\n1. \"When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response.\" (Jake Miller of Bishop Fox Security)\n2. \" When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length.\" (Jake Miller of Bishop Fox Security)\n3. ~\"Twisted should not allow BWS between the filed-name and colon.\" (ZeddYu Lu)~ _closed in 9646_\n4. \"Two CL header with different values is also not allowed.\" (ZeddYu Lu)\n5. \"Only accept identity and chunked Transport-Encoding.\" (ZeddYu Lu)\n\n### Patches\nhttps://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081\nhttps://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281\n\n### Workarounds\nN/A\n\n### References\nhttps://portswigger.net/web-security/request-smuggling\n","published":"2022-10-07T07:31:33Z","modified":"2024-11-30T05:35:16.690034Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"twisted","fixedVersion":"20.3.0"}],"fix":{"url":"https://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081","label":"twisted/twisted@20c787a"},"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-8r99-h8j2-rw64"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-11-30T05:35:16.690034Z"}}