8.3 CVE-2024-41671

 

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.
https://nvd.nist.gov/vuln/detail/CVE-2024-41671

Categories

CWE-444 : Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent(such as a proxy or firewall) in the data flow between twoentities such as a client and server, but it does notinterpret malformed HTTP requests or responses in ways thatare consistent with how the messages will be processed bythose entities that are at the ultimate destination. Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433]. Use only SSL communication. Terminate the client session after each request. Turn all pages to non-cacheable. SSL/TLS-capable proxy allows HTTP smuggling when used in tandem with HTTP/1.0 services, due to inconsistent interpretation and input sanitization of HTTP messages within the body of another message Chain: caching proxy server has improper input validation (CWE-20) of headers, allowing HTTP response smuggling (CWE-444) using an "LF line ending" Node.js platform allows request smuggling via two Transfer-Encoding headers Web servers allow request smuggling via inconsistent HTTP headers. HTTP server allows request smuggling with both a "Transfer-Encoding: chunked" header and a Content-Length header HTTP server allows request smuggling with both a "Transfer-Encoding: chunked" header and a Content-Length header

References


 

CPE

cpe start end


REMEDIATION




EXPLOITS


Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits


CAPEC


Common Attack Pattern Enumerations and Classifications

id description severity
273 HTTP Response Smuggling
High
33 HTTP Request Smuggling
High