PT-2022-4802 · Waitress+6 · Waitress+6
Zeyu2001
·
Published
2022-03-17
·
Updated
2026-04-01
·
CVE-2022-24761
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Waitress versions 2.1.0 and prior
Description
The issue is related to the handling of HTTP requests in Waitress, a Web Server Gateway Interface server for Python 2 and 3. When used behind a proxy that does not properly validate incoming HTTP requests according to the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and ends. This can allow requests to be smuggled via the front-end proxy to Waitress, potentially leading to data integrity issues. Two classes of vulnerability contribute to this issue: the use of Python's
int() to parse strings into integers, which can lead to incorrect parsing (e.g., +10 being parsed as 10, or 0x01 as 1), and Waitress's handling of chunk extensions, where it discards them without validating for illegal characters.Recommendations
For versions 2.1.0 and prior, upgrade to Waitress 2.1.1 to patch the vulnerability. As a temporary workaround, when deploying a proxy in front of Waitress, turn on all functionality to ensure the request matches the RFC7230 standard. However, certain proxy servers may not have this functionality, so upgrading to the latest version of Waitress is recommended.
Exploit
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Waitress