Description

ch4n3-yoon

opened on Aug 16, 2024

Issue body actions

Bug report

Bug description:

Description

A potential Denial of Service (DoS) vulnerability, identified as CVE-2024-7592, has been discovered in the _unquote() method of the http.cookies module in Python's standard library. This vulnerability is particularly concerning as it affects frameworks that utilize this method, including Django.

Vulnerable Code

The _unquote() function uses regular expressions _OctalPatt and _QuotePatt within a while loop to process input strings. The problematic patterns and their application can lead to exponential time complexity under certain conditions, akin to a Regular Expression Denial of Service (ReDoS) attack.

# http/cookies.py
_OctalPatt = re.compile(r"\\[0-3][0-7][0-7]")
_QuotePatt = re.compile(r"[\\].")
def _unquote(str):
    # ... (code omitted for brevity)
    while 0 <= i < n:
        o_match = _OctalPatt.search(str, i)
        q_match = _QuotePatt.search(str, i)
        # ... (further processing)

Impact

This vulnerability has also been verified in the Django framework, where the parse_cookie() function uses this method to process incoming cookie headers. This could potentially be exploited by sending specially crafted cookie values to trigger significant delays:

• Cookie sizes of 8000+ bytes caused delays of approximately 0.15 seconds per HTTP request.
• Cookie sizes of 20000+ bytes resulted in delays of about 1 second per request.

While many environments limit HTTP request sizes, the specific limits vary, and in some cases, this vulnerability could be exploited.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-123067: Denial of Service Vulnerability in http.cookies._unquote() #123066
• gh-123067: Fix quadratic complexity in parsing cookies with backslashes #123075
• [3.13] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075) #123103
• [3.12] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075) #123104
• [3.11] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075) #123105
• [3.10] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075) #123106
• [3.9] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075) #123107
• [3.8] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075) #123108

Activity

1. ch4n3-yoon

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Aug 16, 2024
2. Eclips4

   added

   type-securityA security issueA security issue

   on Aug 16, 2024
3. serhiy-storchaka

   added 2 commits that reference this issue on Aug 16, 2024

   pythongh-123067: Fix quadratic complexity in parsing cookies with bac…

   73e2aa9

   pythongh-123067: Fix quadratic complexity in parsing cookies with bac…

   04ac47b
4. serhiy-storchaka commented on Aug 16, 2024

   

   serhiy-storchaka

   on Aug 16, 2024

   Member

   More actions

   The complexity is quadratic, not exponential.
5. serhiy-storchaka

   added a commit that references this issue on Aug 17, 2024

   gh-123067: Fix quadratic complexity in parsing "-quoted cookie values…

   44e4583
6. miss-islington

   added 6 commits that reference this issue on Aug 17, 2024

   pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

   70390bb

   pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

   6a33a68

   pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

   dcfd909

   pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

   c4412d3

   pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

   15eec9d

   pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

   fa88d41
7. sethmlarson commented on Aug 19, 2024

   

   sethmlarson

   on Aug 19, 2024

   Contributor

   More actions

   Closed in #123075
8. sethmlarson

   closed this as completedon Aug 19, 2024
9. jeremyhylton

   added a commit that references this issue on Aug 19, 2024

   pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

   1587608
10. 3 remaining items
11. blhsing

    added a commit that references this issue on Aug 22, 2024

    pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

    f619de1
12. hauntsaninja commented on Aug 24, 2024

    

    hauntsaninja

    on Aug 24, 2024

    Contributor

    More actions

    @sethmlarson looks like the backports are all unmerged (usually we keep the issue open till that's done)
    Do you know if there's anything we're waiting on to merge them? If not, I can at least merge to 3.13 and 3.12! :-)
13. hauntsaninja

    reopened this on Aug 24, 2024
14. sethmlarson commented on Aug 24, 2024

    

    sethmlarson

    on Aug 24, 2024

    Contributor

    More actions

    @hauntsaninja I don't think there's anything blocking the backports!
15. hauntsaninja

    added 2 commits that reference this issue on Aug 24, 2024

    [3.13] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

    391e562

    [3.12] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

    dcc3eae
16. hauntsaninja commented on Aug 24, 2024

    

    hauntsaninja

    on Aug 24, 2024

    Contributor

    More actions

    Great, I merged to 3.13 and 3.12, the other branches will need the RM to merge
17. serhiy-storchaka commented on Aug 25, 2024

    

    serhiy-storchaka

    on Aug 25, 2024

    Member

    More actions

    AFAIK backports to 3.13 should be approved by other core developer. This is why I did not merge them myself.

    Reacted by Shantanu

    Reacted by stonebig
18. ambv

    added 4 commits that reference this issue on Sep 4, 2024

    [3.8] gh-123067: Fix quadratic complexity in parsing "-quoted cookie …

    a77ab24

    [3.9] gh-123067: Fix quadratic complexity in parsing "-quoted cookie …

    d662e2d

    [3.11] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

    d4ac921

    [3.10] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

    b2f11ca
19. ambv

    closed this as completedon Sep 4, 2024
20. mcepl

    added a commit that references this issue on Sep 18, 2024

    [CVE-2024-7592] Fix quadratic complexity in parsing "-quoted cookie

    cdffb9f
21. vEpiphyte

    added a commit that references this issue on Dec 31, 2024

    Add http.coookies monkeypatch (SYN-8465) (#4045)

    746605b

Issue actions