CVE-2022-39348: Twisted vulnerable to NameVirtualHost Host header injection

Vulnerability summary

CVE-2022-39348 is a medium (CVSS 5.4) vulnerability in debian debian_linux. EPSS estimates a 1.59% chance of exploitation in the next 30 days, higher than 75.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-10-2022
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.

• CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-80Improper Neutralization of Script-Related HTML Tags in a Web PageThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.