Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aiohttp | pip | < 3.8.6 | 3.8.6 |
Miggo AIRoot Cause AnalysisThe vulnerability GHSA-pjjw-qhg8-p2p9 exists because aiohttp versions prior to 3.8.6 used a vulnerable version of the llhttp library for parsing HTTP messages. The llhttp library had request smuggling vulnerabilities.
The analysis of the patches, specifically commit bcc416e533796d04fb8124ef1e7686b1f338767a, shows that the fix was to upgrade the vendored llhttp submodule from version 8.1.1 to 9.1.3.
The vulnerable functions are those in aiohttp that are responsible for taking raw HTTP data and feeding it into the llhttp parser. On the server side, when aiohttp is used to host a web application, the aiohttp.server.ServerHttpProtocol.data_received method receives the data from the network. This data is then passed to aiohttp._http_parser.HttpRequestParser.feed_data, which directly calls the vulnerable C parser.
On the client side, aiohttp uses aiohttp._http_parser.HttpResponseParser.feed_data to parse responses from a server. This could also be an attack vector if the client connects to a malicious server.
Therefore, any runtime profile during an exploit of this vulnerability would show these functions in the stack trace as they are the bridge between the application logic and the vulnerable parsing library.
