Executive brief
Uvicorn is an ASGI web server used to run Python web applications. The default request logging feature is vulnerable to log injection attacks where an attacker can craft malicious URLs containing percent-encoded escape sequences that, when decoded and logged, inject ANSI terminal control codes. This allows attackers to corrupt log files, manipulate terminal display, or potentially execute unintended commands through the terminal emulator displaying the logs.
Technical details
The vulnerability is a log injection flaw (CWE-116, CWE-94) in uvicorn's request logger. When HTTP requests are logged, the logger decodes percent-encoded URL characters using urllib.parse.unquote before writing to logs. An attacker can craft URLs with percent-encoded ANSI escape sequences (e.g., %1B[...) that, once decoded, become literal escape codes in the log output. The attack vector is network-based with no authentication required—any HTTP request can trigger logging. An attacker can pollute access logs, corrupt their integrity, or use ANSI codes to manipulate the terminal emulator displaying or reading those logs in real time. The fix was released in uvicorn 0.11.7, which sanitizes escape sequences before logging.
Affected products
- Encode Uvicorn 0.0.1 through 0.11.6
Timeline
- 2020-07-29: disclosed
- 2020-07-29: patched: Fixed in uvicorn 0.11.7