Vulnerability in gevent.pywsgi.WSGIServer

[mukeran]

• gevent version: 23.7.0 (pypi)
• Python version: 3.8.15
• Operating System: Linux

CVE-2023-41419 has been assigned to this issue. Fixed in 23.9.0.

Description

Previously, carefully crafted invalid trailers in chunked requests on keep-alive connections might appear as two requests to gevent.pywsgi. Because this was handled exactly as a normal keep-alive connection with two requests, the WSGI application should handle it normally. However, if you were counting on some upstream server to filter incoming requests based on paths or header fields, and the upstream server simply passed trailers through without validating them, then this embedded second request would bypass those checks. (If the upstream server validated that the trailers meet the HTTP specification, this could not occur, because characters that are required in an HTTP request, like a space, are not allowed in trailers.) (source - docs/changes/1989.bugfix)

Payload

POST /path1 HTTP/1.1
Host: a.com
Transfer-Encoding: chunked
Connection: keep-alive

2
a2
0
Header: value
POST /path2?a=:123 HTTP/1.1
Host: a.com
Connection: close

Credit

Fixed by @jamadden.
Reported by Keran Mu (@mukeran) and Jianjun Chen (@chenjj), from Tsinghua University and Zhongguancun Laboratory.

[jamadden]

Thank you for your interest in gevent and your bug report. While gevent.pywsgi has never been advertised as an Internet-facing, production-ready implementation and users have been advised to use something that is, like gunicorn, or at the very least a secure reverse proxy, I will prioritize a fix for this issue.

[jamadden]

gevent 23.9 has been released with tests and a fix for this. Thank you again for the report.

[mukeran]

@jamadden Hi. Sorry for my late response and thanks for your quick fix. Here's a request:
According to MITRE's email, if I want to make the CVE public, I have to modify the description of this issue with the (negative) detail of this vulnerability.
Is it OK to replace my description with details of the vulnerability since the issue has been fixed?

[jamadden]

I don't see why not; the release notes already include a summary.

[mukeran]

OK, thanks.