Log in Start free

Vulnerability · Published Oct 26, 2022 · Assigned by GitHub_M

CVE-2022-39348Twisted vulnerable to NameVirtualHost Host header injection

Medium 5.4

In plain English

A medium-severity cross-site scripting in twisted from twisted. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.6%top 24.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12twisted22.4.0-4DEBIAN-CVE-2022-39348
Debian:13twisted22.4.0-4DEBIAN-CVE-2022-39348
Debian:14twisted22.4.0-4DEBIAN-CVE-2022-39348
PyPItwisted22.10.0rc1GHSA-vg46-2rrj-3647
PyPItwisted22.10.0rc1PYSEC-2026-1055
Ubuntu:22.04:LTStwisted22.1.0-2ubuntu2.4USN-6575-1
Ubuntu:22.04:LTStwisted22.1.0-2ubuntu2.4UBUNTU-CVE-2022-39348

Affected products (as reported)

VendorProductVersions
twisted twisted >= 0.9.4, < 22.10.0rc1

Weakness: CWE-80, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References