Exploit
CVE-2023-49082

Improper Input Validation (CWE-20)

Published: Nov 26, 2023

010
CVSS 5.3EPSS 0.04%Medium
CVE info copied to clipboard

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Timeline

Vendor Advisory

GitHub Advisories released a security advisory.

Nov 26, 2023 at 5:33 PM
First Article

Feedly found the first article mentioning CVE-2023-49082. See article

Nov 27, 2023 at 11:24 PM / GitHub Advisory Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 27, 2023 at 11:24 PM
CVE Assignment

NVD published the first details for CVE-2023-49082

Nov 29, 2023 at 12:15 PM
Vendor Advisory

RedHat CVE advisory released a security advisory (CVE-2023-49082).

Nov 30, 2023 at 11:00 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 6.9%)

Dec 1, 2023 at 2:35 PM
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Dec 4, 2023 at 11:10 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (284846)

Jan 8, 2024 at 12:00 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (187672)

Jan 8, 2024 at 12:15 AM
Static CVE Timeline Graph

Affected Systems

Aiohttp/aiohttp
+null more

Exploits

https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b
+null more

Patches

bugzilla.redhat.com
+null more

Links to Mitre Att&cks

T1562.003: Impair Command History Logging
+null more

Attack Patterns

CAPEC-10: Buffer Overflow via Environment Variables
+null more

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:None
Integrity:Low
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI