Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency twisted to v24.7.0 [security] #5

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency twisted to v24.7.0 [security] #5

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 25, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
twisted (changelog) 24.3.0 -> 24.7.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-41671

Summary

The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.

PoC

  1. Start a fresh Debian container:
docker run --workdir /repro --rm -it debian:bookworm-slim
  1. Install twisted and its dependencies:
apt -y update && apt -y install ncat git python3 python3-pip \
    && git clone --recurse-submodules https://github.com/twisted/twisted \
    && cd twisted \
    && pip3 install --break-system-packages .
  1. Run a twisted.web HTTP server that echos received requests' methods. e.g., the following:
from twisted.web import server, resource
from twisted.internet import reactor

class TheResource(resource.Resource):
    isLeaf = True

    def render_GET(self, request) -> bytes:
        return b"GET"

    def render_POST(self, request) -> bytes:
        return b"POST"

site = server.Site(TheResource())
reactor.listenTCP(80, site)
reactor.run()
  1. Send it a POST request with a chunked message body, pipelined with another POST request, wait a second, then send a GET request on the same connection:
(printf 'POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nPOST / HTTP/1.1\r\nContent-Length: 0\r\n\r\n'; sleep 1; printf 'GET / HTTP/1.1\r\n\r\n'; sleep 1) | nc localhost 80
  1. Observe that the responses arrive out of order:
HTTP/1.1 200 OK
Server: TwistedWeb/24.3.0.post0
Date: Tue, 09 Jul 2024 06:19:41 GMT
Content-Length: 5
Content-Type: text/html

POST
HTTP/1.1 200 OK
Server: TwistedWeb/24.3.0.post0
Date: Tue, 09 Jul 2024 06:19:42 GMT
Content-Length: 4
Content-Type: text/html

GET
HTTP/1.1 200 OK
Server: TwistedWeb/24.3.0.post0
Date: Tue, 09 Jul 2024 06:19:42 GMT
Content-Length: 5
Content-Type: text/html

POST

Impact

See GHSA-xc8x-vp79-p3wm. Further, for instances of twisted.web HTTP servers deployed behind reverse proxies that implement connection pooling, it may be possible for remote attackers to receive responses intended for other clients of the twisted.web server.

CVE-2024-41810

Summary

The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.

Details

Twisted’s redirectTo function generates an HTTP 302 Redirect response. The response contains an HTML body, built for exceptional cases where the browser doesn’t properly handle the redirect, allowing the user to click a link, navigating them to the specified destination.

The function reflects the destination URL in the HTML body without any output encoding.

# https://github.com/twisted/twisted/blob/trunk/src/twisted/web/_template_util.py#L88
def redirectTo(URL: bytes, request: IRequest) -> bytes:
    # ---snip---
    content = b"""
<html>
    <head>
        <meta http-equiv=\"refresh\" content=\"0;URL=%(url)s\">
    </head>
    <body bgcolor=\"#FFFFFF\" text=\"#&#8203;000000\">
    <a href=\"%(url)s\">click here</a>
    </body>
</html>
""" % {
        b"url": URL
    }
    return content

If an attacker has full or partial control over redirect location due to an application bug, also known as an “Open Redirect”, they may inject arbitrary HTML into the response’s body, ultimately leading to an XSS attack.

It’s worth noting that the issue is known to maintainers and tracked with GitHub Issue#9839. The issue description, however, does not make any mention of exploitability and simply states: “…Browsers don't seem to actually render that page…”

PoC

The issue can be reproduced by running the following Twisted-based HTTP server locally:

from twisted.web import server, resource
from twisted.internet import reactor
from twisted.web.util import redirectTo

class Simple(resource.Resource):
    isLeaf = True
    def render_GET(self, request):
        url = request.args[b'url'][0]  # <-- open redirect
        return redirectTo(url, request)

site = server.Site(Simple())
reactor.listenTCP(9009, site)
reactor.run()

Once running, navigate to the following URL: http://127.0.0.1:9009?url=ws://example.com/"><script>alert(document.location)</script>, and verify that the “alert” dialog was displayed.

Note: Due to the different ways browsers validate the redirect Location header, this attack is possible only in Firefox. All other tested browsers will display an error message to the user and will not render the HTML body.

Impact

If successfully exploited, the issue will allow malicious JavaScript to run in the context of the victim's session. This will in turn lead to unauthorized access/modification to victim's account and information associated with it, or allow for unauthorized operations to be performed within the context of the victim's session.

Release Notes

twisted/twisted (twisted)

v24.7.0: Twisted 24.7.0

Compare Source

Twisted 24.7.0 (2024-08-08)

24.7.0.rc2 fixed an unreleased regression caused by PR 12109. (#​12279)
No other changes since 24.7.0.rc2

Features

  • twisted.protocols.ftp now supports the IPv6 extensions defined in RFC 2428. (#​9645)
  • twisted.internet.defer.inlineCallbacks can now yield a coroutine. (#​9972)
  • twisted.python._shellcomp.ZshArgumentsGenerator was updated for Python 3.13. (#​12065)
  • twisted.web.wsgi request environment now contains the peer port number as REMOTE_PORT. (#​12096)
  • twisted.internet.defer.Deferred.callback() and twisted.internet.defer.Deferred.addCallbacks() no longer use assert to check the type of the arguments. You should now use type checking to validate your code. These changes were done to reduce the CPU usage. (#​12122)
  • Added two new methods, twisted.logger.Logger.failuresHandled and twisted.logger.Logger.failureHandler, which allow for more concise and convenient handling of exceptions when dispatching out to application code. The former can arbitrarily customize failure handling at the call site, and the latter can be used for performance-sensitive cases where no additional information needs to be logged. (#​12188)
  • twisted.internet.defer.Deferred.addCallback now runs about 10% faster. (#​12223)
  • twisted.internet.defer.Deferred error handling is now faster, taking 40% less time to run. (#​12227)

Bugfixes

  • Fixed unreleased regression caused by PR #​12109. (#​12279)
  • twisted.internet.ssl.Certificate.repr can now handle certificates without a common name (CN) in the certificate itself or the signing CA. (#​5851)
  • Type annotations have been added to twisted.conch.interfaces.IKnownHostEntry and its implementations, twisted.conch.client.knownhosts.PlainHost and twisted.conch.client.knownhosts.HashedHost, correcting a variety of type confusion issues throughout the conch client code. (#​9713)
  • twisted.python.failure.Failure once again utilizes the custom pickling logic it used to in the past. (#​12112)
  • twisted.conch.client.knownhosts.KnownHostsFile.verifyHostKey no longer logs an exception when automatically adding an IP address host key, which means the interactive conch command-line no longer will either. (#​12141)

Improved Documentation

  • The IRC server example found in the documentation was updated for readability. (#​12097)
  • Remove contextvars from list of optional dependencies. (#​12128)
  • The documentation for installing Twisted was moved into a single page. (#​12145)
  • The project's compatibility policy now clearly indicates that the GitHub Actions test matrix defines the supported platforms. (#​12167)
  • Updated imap4client.py example, it no longer references Python 2. (#​12252)

Deprecations and Removals

  • twisted.internet.defer.returnValue has been deprecated. You can replace it with the standard return statement. (#​9930)
  • The twisted-iocpsupport is no longer a hard dependency on Windows.
    The IOCP support is now installed together with the other Windows soft
    dependencies via twisted[windows-platform]. (#​11893)
  • twisted.python.deprecate helper function will now always strip whitespaces from the docstrings.
    This is done to have the same behaviour as with Python 3.13. (#​12063)
  • twisted.conch.manhole.ManholeInterpreter.write, twisted.conch.manhole.ManholeInterpreter.addOutput, twisted.mail.imap4.IMAP4Server.sendUntaggedResponse async argument, deprecated since 18.9.0, has been removed. (#​12130)
  • twisted.web.soap was removed.
    The SOAP support was already broken, for at least the last 4 years.
    The SOAP support in Twisted has no active maintainer. (#​12146)

Misc

Conch

Bugfixes


- twisted.conch.insults.window.Widget.functionKeyReceived now dispatches functional key events to corresponding `func_KEYNAME` methods, where `KEYNAME` can be `F1`, `F2`, `HOME`, `UP_ARROW` etc. This is a regression introduced with #&#8203;8214 in Twisted 16.5.0, where events changed from `const` objects to bytestrings in square brackets like `[F1]`. (#&#8203;12046)

Web
---

Features
  • twisted.web.agent.Agent now allows duplicate Content-Length headers having the same value, per RFC 9110 section 8.6. It is otherwise more strict when parsing Content-Length header values. (#​9064)
  • twisted.web.client.HTTPConnectionPool used by HTTP clients now runs faster by using a little less CPU. (#​12108)
  • twisted.web.http_headers now uses less CPU, making a small HTTP client request 10% faster or so. (#​12116)
  • twisted.web's HTTP/1.1 server now runs a little faster, with about 10% lower CPU overhead. (#​12133)
  • twisted.web's HTTP 1.1 server is an additional 5% faster. (#​12155)

Bugfixes


- twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback response body it returns (GHSA-cf56-g6w6-pqq2, CVE-2024-41810). (#&#8203;9839)
- twisted.web.http.IM_A_TEAPOT was added and returns `I'm a teapot`
  as default message for the status code 418,
  as defined in RFC 2324 section 2.3.2. (#&#8203;12104)
- The HTTP 1.0/1.1 server provided by twisted.web is now more picky about the first line of a request, improving compliance with RFC 9112. (#&#8203;12233)
- The HTTP 1.0/1.1 server provided by twisted.web now contains the characters set of HTTP header names, improving compliance with RFC 9110. (#&#8203;12235)
- The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure (CVE-2024-41671/GHSA-c8m8-j448-xjx7) (#&#8203;12248)
- twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback response body it returns (GHSA-cf56-g6w6-pqq2). The issue is being tracked with CVE-2024-41810. (#&#8203;12263)

Improved Documentation
  • Fix ReverseProxyResource example in developer guide. (#​12152)

Deprecations and Removals


- twisted.web.util.ChildRedirector, which has never worked on Python 3, has been removed. (#&#8203;9591)
- ``twisted.web.http.Request.setResponseCode()`` no longer validates the types of inputs; we encourage you to use a type checker like mypy to catch these sort of errors. The long-deprecated ``twisted.web.server.string_date_time()`` and ``twisted.web.server.date_time_string()`` APIs were removed altogether. (#&#8203;12133)
- twisted.web.http.HTTPClient is now deprecated in favor of twisted.web.client.Agent (#&#8203;12158)

Misc
~~~~

- #&#8203;12098, #&#8203;12194, #&#8203;12200, #&#8203;12241, #&#8203;12257

Mail
----

No significant changes.

Words
-----

No significant changes.

Names
-----

No significant changes.

Trial
-----

No significant changes.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai coderabbitai
Copy link

coderabbitai bot commented Sep 25, 2024 •
edited
Loading

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@socket-security Socket Security
Copy link

socket-security bot commented Sep 25, 2024 •
edited
Loading

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
pypi/[email protected] environment, eval, filesystem, shell 0 134 kB exarkun, hawkowl, rodrigc

🚮 Removed packages: pypi/[email protected], pypi/[email protected], pypi/[email protected]

View full report↗︎

@renovate renovate bot changed the title fix(deps): update dependency twisted to v24.7.0 [security] fix(deps): update dependency twisted to v24.7.0 [security] - autoclosed Sep 25, 2024
@renovate renovate bot closed this Sep 25, 2024
@renovate renovate bot deleted the renovate/pypi-twisted-vulnerability branch September 25, 2024 17:26
@renovate renovate bot changed the title fix(deps): update dependency twisted to v24.7.0 [security] - autoclosed fix(deps): update dependency twisted to v24.7.0 [security] Sep 26, 2024
@renovate renovate bot reopened this Sep 26, 2024
@renovate renovate bot restored the renovate/pypi-twisted-vulnerability branch September 26, 2024 19:08
@renovate renovate bot force-pushed the renovate/pypi-twisted-vulnerability branch from 85f940e to 67488aa Compare September 26, 2024 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
size/XS
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants