CVE-2023-49082: aiohttp's ClientSession is vulnerable to CRLF injection via method

Vulnerability summary

CVE-2023-49082 is a medium (CVSS 5.3) Improper Input Validation vulnerability in aio-libs aiohttp. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 61.2% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 29-11-2023
   PublishedVulnerability first disclosed.
2. 23-06-2026
   Last modifiedVulnerability information updated.

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-93Improper Neutralization of CRLF SequencesThe product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.