Executive Summary

This vulnerability exists in daphne versions before 4.2.2, where it reconstructs a raw HTTP request from Twisted's parsed headers and passes it to autobahn for WebSocket handshake processing.

Twisted does not recognize certain byte values (\x0b, \x0c, \x1c, \x1d, \x1e, or \x85) as header line separators, but autobahn decodes header values to strings and splits them by lines.

This difference in parsing allows an attacker to inject additional headers into the ASGI scope that is passed to the application.

Daphne 4.2.2 and later versions mitigate this by rejecting requests containing these bytes in any header value with a 400 response.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can inject additional HTTP headers into the ASGI scope passed to the application.

This could potentially lead to unexpected behavior in the application, such as bypassing security controls or manipulating application logic that relies on header values.

However, the CVSS score of 3.7 indicates a low severity impact, with low confidentiality impact and no integrity or availability impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade daphne to version 4.2.2 or later, as this version rejects requests containing the problematic bytes in any header value with a 400 response.

Useful 0 Not Useful 0