CVE-2024-49768
📋 TL;DR
A race condition in Waitress web server allows HTTP pipelining attacks when request lookahead is enabled. Remote attackers can bypass connection closure after parsing errors to process unauthorized secondary requests. This affects Python applications using Waitress with request lookahead enabled.
💻 Affected Systems
- Waitress
📦 What is this software?
Waitress by Agendaless
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass security controls to execute unauthorized requests, potentially leading to data exposure, privilege escalation, or server compromise.
Likely Case
Unauthorized request processing allowing data access or manipulation, though limited to what the worker thread can process.
If Mitigated
With request lookahead disabled (default), the vulnerability is not exploitable as connections close properly on parsing errors.
🎯 Exploit Status
Requires HTTP pipelining and specific timing conditions when request lookahead is enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Waitress 3.0.1
Vendor Advisory: https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj
Restart Required: Yes
Instructions:
1. Upgrade Waitress to version 3.0.1 or later using pip: pip install --upgrade waitress>=3.0.1
2. Restart all Waitress services
3. Verify the new version is running
🔧 Temporary Workarounds
Disable request lookahead
allSet channel_request_lookahead to 0 to disable the vulnerable feature
In Waitress configuration, ensure channel_request_lookahead = 0
🧯 If You Can't Patch
- Ensure channel_request_lookahead is set to 0 in all Waitress configurations
- Implement network controls to block or monitor HTTP pipelining requests
🔍 How to Verify
Check if Vulnerable:
Check Waitress version and configuration: if version < 3.0.1 AND channel_request_lookahead > 0, system is vulnerableCheck Version:
pip show waitress | grep VersionVerify Fix Applied:
Confirm Waitress version is 3.0.1 or higher and channel_request_lookahead is 0 or the system is patched📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP requests on same connection with parsing errors
- Unexpected request processing after error responses
Network Indicators:
- HTTP pipelining requests to Waitress servers
- Multiple requests sent before receiving responses
SIEM Query:
source="waitress" AND ("parsing error" OR "HTTP/1.1" AND "pipelining")