CVE-2024-49768
Waitress HTTP Pipelining Request Hijacking Vulnerability
Description
Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.
INFO
Published Date :
Oct. 29, 2024, 3:15 p.m.
Last Modified :
Nov. 7, 2024, 5:28 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.2
Exploitability Score :
3.9
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-49768.
| URL | Resource |
|---|---|
| https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65 | Patch |
| https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj | Vendor Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-49768 vulnerability anywhere in the article.
-
Cybersecurity News
Researchers Uncover XenoRAT’s New Tactics Leveraging Excel XLL Files and Advanced Obfuscation
Hunt researchers have discovered a novel deployment of XenoRAT, an open-source remote access tool (RAT), leveraging Excel XLL files and advanced obfuscation methods. Known for targeting gamers and pos ... Read more
-
Cybersecurity News
Critical Vulnerability in Waitress WSGI Server: CVE-2024-49768 – What You Need to Know
The Pylons Project has released a crucial security advisory addressing a vulnerability in the Waitress WSGI server, tracked as CVE-2024-49768. This vulnerability, assigned a CVSS score of 9.1, represe ... Read more
The following table lists the changes that have been made to the
CVE-2024-49768 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 07, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Changed Reference Type https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65 No Types Assigned https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65 Patch Changed Reference Type https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj No Types Assigned https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj Vendor Advisory Added CPE Configuration OR *cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:* versions from (including) 2.0.0 up to (excluding) 3.0.1 -
CVE Received by [email protected]
Oct. 29, 2024
Action Type Old Value New Value Added Description Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature. Added Reference GitHub, Inc. https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj [No types assigned] Added Reference GitHub, Inc. https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65 [No types assigned] Added CWE GitHub, Inc. CWE-367 Added CWE GitHub, Inc. CWE-444 Added CVSS V3.1 GitHub, Inc. AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-49768 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-49768
weaknesses.