PT-2023-8632 · Twisted+5 · Twisted+5
Mukeran
·
Publicado
2023-10-25
·
Atualizado
2025-09-05
·
CVE-2023-46137
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Twisted versions prior to 23.10.0rc1
Description
The issue is related to the inconsistent interpretation of HTTP requests in the twisted.web component of the Twisted framework. When sending multiple HTTP requests in one TCP packet, twisted.web processes the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launches two requests using HTTP pipeline.
Recommendations
For Twisted versions prior to 23.10.0rc1, update to version 23.10.0rc1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of HTTP pipeline for sensitive requests until the issue is resolved. Restrict access to endpoints that can be controlled by an attacker to minimize the risk of exploitation.
Exploit
Correção
HTTP Request/Response Smuggling
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astra Linux
Linuxmint
Red Os
Suse
Twisted
Ubuntu