CVE-2020-35678

Vulnerability

Overview

CVE-2020-35678 is a redirect header injection vulnerability in Autobahn|Python versions prior to 20.12.3. The flaw occurs during HTTP redirect handling when the library fails to properly re-encode the URL, allowing an attacker-controlled redirect to inject arbitrary HTTP headers. [1][3]

Exploitation and

Attack Surface

An attacker can exploit this by crafting a malicious server response that includes a redirect URL containing encoded newline characters (e.g., %0d%0a). The vulnerable library processes this redirect without sanitizing or re-encoding the URL, thereby injecting additional HTTP headers into the subsequent request. This attack requires the attacker to control a server that the client connects to, or to perform a man-in-the-middle (MitM) attack on the connection. [3][4]

Impact

Successful exploitation enables an attacker to perform HTTP header injection, which could lead to request smuggling, session hijacking, or bypassing security controls such as same-origin policies. In scenarios where the client handles cookies or authentication tokens, the attacker may be able to steal or manipulate those credentials. [4]

Mitigation

The vulnerability is fixed in Autobahn|Python version 20.12.3 and later. Users are strongly advised to upgrade to this version or later. The fix ensures that URLs are properly re-encoded when handling redirect responses, preventing the injection of malicious headers. No workarounds have been documented for older versions. [1]