bottle 0.11.2 vulnerabilities

Known vulnerabilities in the bottle package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H Denial of Service (DoS) Affected versions of this package are vulnerable to Denial of Service (DoS) due to mishandling of errors during early request binding. How to fix Denial of Service (DoS)? Upgrade `bottle` to version 0.12.20 or higher.	[,0.12.20)
M Web Cache Poisoning Affected versions of this package are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. PoC `GET /?q=legitimate&utm_content=1;q=malicious HTTP/1.1 Host: example.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,imag e/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close` The server sees 3 parameters here: `q`, `utm_content` and then `q` again. On the other hand, the proxy considers this full string: `1;q=malicious` as the value of `utm_content`, which is why the cache key would only contain `somesite.com/?q=legitimate`. How to fix Web Cache Poisoning? Upgrade `bottle` to version 0.12.19 or higher.	[0,0.12.19)
M HTTP Response Splitting `bottle` is a Fast and simple WSGI-framework for small web-applications. It was found that redirect() in bottle.py doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.	[0.10.1,0.12.11)
M Arbitrary Code Execution `bottle` is a Fast and simple WSGI-framework for small web-applications. Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.	[0.8,0.10.12)[0.11,0.11.7)[0.12,0.12.6)

Vulnerability

Vulnerable Version

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) due to mishandling of errors during early request binding.

How to fix Denial of Service (DoS)?

Upgrade bottle to version 0.12.20 or higher.

[,0.12.20)

Web Cache Poisoning

Affected versions of this package are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

PoC

GET /?q=legitimate&utm_content=1;q=malicious HTTP/1.1

Host: example.com

Upgrade-Insecure-Requests: 1		

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,imag e/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate			

Accept-Language: en-US,en;q=0.9 Connection: close

The server sees 3 parameters here: q, utm_content and then q again. On the other hand, the proxy considers this full string: 1;q=malicious as the value of utm_content, which is why the cache key would only contain somesite.com/?q=legitimate.

How to fix Web Cache Poisoning?

Upgrade bottle to version 0.12.19 or higher.

[0,0.12.19)

HTTP Response Splitting

bottle is a Fast and simple WSGI-framework for small web-applications. It was found that redirect() in bottle.py doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

[0.10.1,0.12.11)

Arbitrary Code Execution

bottle is a Fast and simple WSGI-framework for small web-applications. Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.

[0.8,0.10.12)[0.11,0.11.7)[0.12,0.12.6)

bottle@0.11.2 vulnerabilities

Fast and simple WSGI-framework for small web-applications.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?

PoC