
CVE-2026-48710漏洞验证代码
#原理:
Starlette是一个开源轻量级的Python ASGI框架
源于Starlette框架在url数据结构处理中信任客户端发送的host,直接拼接到url变量做后续鉴权处理
原始url被处理 uvicorn\protocols\http\httptools_impl.py
def on_message_begin(self) -> None:
self.url = b""
self.expect_100_continue = False
self.headers = []
self.scope = {
"type": "http",
"asgi": {"version": self.asgi_version, "spec_version": "2.3"},
"http_version": "1.1",
"server": self.server,
"client": self.client,
"scheme": self.scheme,
"root_path": self.root_path,
"headers": self.headers,
"state": self.app_state.copy(),
}
# Parser callbacks
def on_url(self, url: bytes) -> None:
self.url += url #self.url设置为原始url
def on_header(self, name: bytes, value: bytes) -> None:
name = name.lower()
if name == b"expect" and value.lower() == b"100-continue":
self.expect_100_continue = True
self.headers.append((name, value))
def on_headers_complete(self) -> None:
http_version = self.parser.get_http_version()
method = self.parser.get_method()
self.scope["method"] = method.decode("ascii")
if http_version != "1.1":
self.scope["http_version"] = http_version
if self.parser.should_upgrade() and self._should_upgrade():
return
parsed_url = httptools.parse_url(self.url)#使用httptools拆分原始url
raw_path = parsed_url.path #raw_path设置为原始url拆分出的path(访问的path)
path = raw_path.decode("ascii") #path设置为使用ascii解码以后的原始path值
if "%" in path: #处理url解码以后的中文从重编码
path = urllib.parse.unquote(path)
full_path = self.root_path + path
full_raw_path = self.root_path.encode("ascii") + raw_path
self.scope["path"] = full_path
self.scope["raw_path"] = full_raw_path
self.scope["query_string"] = parsed_url.query or b""
(我手打的注释)
这段代码在class URL:方法里面
代码:\starlette\datastructures.py
host_header = None for key, value in scope["headers"]: if key == b"host": host_header = value.decode("latin-1") break if host_header is not None: url = f"{scheme}://{host_header}{path}" #基于用户传入的请求头二次定义url
在starlette\routing.py 中:
route_path = get_route_path(scope)
if scope["type"] == "http" and self.redirect_slashes and route_path != "/":
redirect_scope = dict(scope)
if route_path.endswith("/"):
redirect_scope["path"] = redirect_scope["path"].rstrip("/")
else:
redirect_scope["path"] = redirect_scope["path"] + "/"
for route in self.routes:
match, child_scope = route.matches(redirect_scope)
if match != Match.NONE:
redirect_url = URL(scope=redirect_scope) #调用URL方法
response = RedirectResponse(url=str(redirect_url))
await response(scope, receive, send)
return
导致用户发送带有host请求头的畸形请求发往需要鉴权的端点,在路由层url被二次定义为无需鉴权的端点
例如 在http://127.0.0.1:9999/admin
这个url中 admin是需要鉴权端点
发送数据包
url = http://127.0.0.1:9999/admin
header{
host = 123?
}
二次定义url改为http://123?/admin
此时使用urlsplit函数解析url
结果SplitResult(scheme='http', netloc='123', path='', query='/admin', fragment='')
因为path=''所以后续鉴权认为用户访问的网站根目录,所以直接通过,实际返回admin目录内容