Wsgiserver 0.2 Cpython 3.10.4 Exploit
Unconfigured servers expose implementation details via the Server HTTP header, signaling to attackers that a legacy stack is in use.
The "wsgiserver 0.2" and "CPython 3.10.4" combination represents a snapshot of the Python web ecosystem from early 2022. Python 3.10.4 was released in late March 2022, and at that time, "WSGIServer/0.2" was the standard server version identifier for both the simple development server in the standard library ( wsgiref.simple_server ) and several standalone, production-oriented WSGI servers, such as the one maintained by Ralph Wetzel. wsgiserver 0.2 cpython 3.10.4 exploit
POST /path1 HTTP/1.1 Host: a.com Transfer-Encoding: chunked Connection: keep-alive POST /path1 HTTP/1
GET /admin HTTP/1.1 Host: target-vm
The exploit relies on a specific configuration of WSGIServer 0.2 and CPython 3.10.4. An attacker would need to send a crafted request to the server, which would then execute malicious code. The exploit is particularly concerning, as it could allow an attacker to gain control over the server. | Factor | Rating | Notes | |
| Factor | Rating | Notes | | :--- | :--- | :--- | | | Medium | Automated scanners frequently probe for generic WSGI flaws. | | Impact | High | Successful smuggling leads to auth bypass; DoS leads to service outage. | | CVSS Score | 7.5 (High) | Estimated based on Network vector and Low complexity. |
