Uvicorn HTTP Response Splitting Vulnerability

A vulnerability allowing HTTP response splitting has been identified in Uvicorn versions prior to 0.11.7. This issue arises because CRLF sequences are not properly escaped in HTTP header values. As a result, attackers can exploit this flaw to inject arbitrary headers into HTTP responses or even return custom response bodies, whenever crafted input is used to create HTTP headers.

Impact

Exploitation of this vulnerability allows for HTTP response splitting, which can lead to various attacks such as cross-site scripting or injection of malicious headers that could be exploited by the client or intermediary servers.

Reproduction

To reproduce this vulnerability, send a GET request to a Uvicorn server running an application that uses the httptools parser. Include a crafted URL path that contains CRLF sequences. Uvicorn will respond with an additional HTTP header corresponding to the injected header from the request, demonstrating the successful exploitation of the HTTP response splitting vulnerability.

Remediation

Upgrade Uvicorn to version 0.11.7 or higher.