rootđź’€senseicat:~#
Hack. Eat. Sleep. Repeat!!!
Project maintained by SENSEiXENUS
Hosted on GitHub Pages — Theme by mattgraham
Python’s cython httplib set_tunnel CRLF issue

- Affected code in http.client._tunnel()-:
#Line 984
for header, value in self._tunnel_headers.items():
headers.append(f"{header}: {value}\r\n".encode("latin-1"))
headers.append(b"\r\n")
- It directly passes headers values without filtering input for \r\n leading to injection of new headers through a header’s value.
- Proof-of-concept-:

Result-:
