uvicorn Request Logger urllib.parse.unquote Escape Sequence code injection

Summaryinfo

A vulnerability described as critical has been identified in uvicorn. Impacted is an unknown function in the library urllib.parse.unquote of the component Request Logger. Executing a manipulation as part of Escape Sequence can lead to code injection. This vulnerability is registered as CVE-2020-7694. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in uvicorn (unknown version). It has been declared as critical. This vulnerability affects an unknown code block in the library urllib.parse.unquote of the component Request Logger. The manipulation as part of a Escape Sequence leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).

The weakness was published 07/27/2020 (GitHub Repository). The advisory is available at github.com. This vulnerability was named CVE-2020-7694 since 01/21/2020. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-159011. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• uvicorn

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion