CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection
Attacker can inject HTML or scripts via Host header in Twisted web applications, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-39348?
CVE-2022-39348 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 26 Oct 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
Which versions are affected by CVE-2022-39348?
3 open source packages ship an affected version, including twisted and Twisted. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
twisted PyPI | From 0.9.4 | 22.10.0rc1 |
twisted PyPI | From 0.9.4 | 22.10.0rc1 |
Twisted PyPI | From 0.9.4 | 22.10.0rc1 |
Linux distribution packages (7)
python-Twisted SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 19.10.0-150200.3.18.1 |
python-Twisted SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 19.10.0-150200.3.18.1 |
python-Twisted SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 22.2.0-150400.5.7.1 |
python-Twisted openSUSE:Leap 15.3 | All versions | 19.10.0-150200.3.18.1 |
python-Twisted openSUSE:Leap 15.4 | All versions | 19.10.0-150200.3.18.1 |
python-Twisted openSUSE:Leap 15.4 | All versions | 22.2.0-150400.5.7.1 |
python-Twisted openSUSE:Tumbleweed | All versions | 22.10.0-1.1 |
Products include Debian Debian Linux, Twisted Twisted.
How do I fix CVE-2022-39348?
Upgrade twisted to 22.10.0rc1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-39348 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39348 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-11357, DEBIAN-CVE-2022-39348, DLA-3212-1, GHSA-vg46-2rrj-3647, MGASA-2023-0061, OESA-2023-1910 and 6 more.