HTTP Request Smuggling Affecting eventlet package, versions [,0.34.3)
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-EVENTLET-6514873
- published 1 Apr 2024
- disclosed 1 Apr 2024
- credit Keran Mu, Jianjun Chen
How to fix?
Upgrade eventlet to version 0.34.3 or higher.
Overview
eventlet is a Highly concurrent networking library
Affected versions of this package are vulnerable to HTTP Request Smuggling due to accepting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks.
Note:
The reject_bad_request option that was included in the fix, if disabled, allows these requests for compatibility with older servers that cannot be updated.
PoC
curl -d "param1=value1¶m2=value2" -X POST -H 'Transfer-Encoding:
chunked' -H 'Content-Length: 0' --http1.1 http://0.0.0.0:8090 -i
References
CVSS Scores
version 3.1