Uvicorn Log Injection Vulnerability Allowing ANSI Escape Sequence Injection

A log injection vulnerability has been identified in all versions of the Uvicorn package. This issue arises from the request logger, which is susceptible to ANSI escape sequence injection. By sending crafted URLs with percent-encoded escape sequences, attackers can manipulate the logged output. Uvicorn logs HTTP request details to the console or a log file, processing the URLs with urllib.parse.unquote. This conversion can unintentionally introduce special characters that terminals interpret in specific ways. Exploitation of this vulnerability can lead to two main consequences: corrupting Uvicorn's access logs and using ANSI codes to interact with the terminal emulator displaying the logs, either live or from a file.

Impact

Exploitation of this vulnerability allows for log injection, where crafted requests can alter the contents of Uvicorn's access logs. This not only disrupts the integrity of the log files but also opens the possibility for ANSI escape sequences to be executed, potentially interfering with the terminal emulator's display of the logs.

Reproduction

To reproduce this vulnerability, send an HTTP request to a Uvicorn server with a URL that includes percent-encoded escape sequences. Uvicorn will log the request after decoding the URL, which can introduce ANSI escape codes. This can be done using a tool like curl, specifying a crafted URL that, once decoded, contains escape sequences that could be interpreted by a terminal.

Remediation

Upgrade Uvicorn to version 0.11.7 or higher.