CVE-2020-7694

What it actually does

The vulnerability allows an unauthenticated, remote attacker to inject ANSI escape sequences into application logs by sending a specially crafted HTTP request. The uvicorn server's logging component decodes percent-encoded characters in the URL path before writing to the log. When these logs are viewed in a terminal emulator, the embedded escape sequences are interpreted, which can corrupt the log display, hide malicious entries, or execute commands in the context of the terminal user.

Why it matters to the business

This flaw compromises the integrity of application logs, which are critical for security monitoring, incident response, and forensic analysis. Attackers can tamper with logs to hide their activities, misleading security teams and disrupting operations. In a worst-case scenario, an administrator viewing the logs could be tricked into executing malicious commands, potentially leading to a wider system compromise. This undermines trust in operational data and can increase the time and cost of responding to security incidents.

How an attack unfolds

An attacker identifies a web application using a vulnerable version of the uvicorn web server. The attacker crafts a URL containing percent-encoded ANSI escape sequences, such as codes to change text color, clear the screen, or redefine keyboard keys. They send an HTTP request to this URL. The uvicorn server receives the request, decodes the URL path, and writes the raw escape sequences into its access log. Later, when a system administrator or developer views this log file using a standard terminal (e.g., `tail -f app.log`), their terminal interprets the escape sequences. This can be used to obfuscate other attack logs or, with more advanced sequences, trick the user into unknowingly executing commands by pressing what they believe are normal keys.

How to fix it

The definitive fix is to upgrade the `uvicorn` package to version 0.11.5 or later. These versions correctly sanitize log output to prevent control character injection. If an immediate upgrade is not possible, mitigate by configuring log viewers to escape or display non-printable characters (e.g., use `cat -v` or `less -r` instead of `cat` or `less`). Avoid viewing raw logs directly in a terminal emulator. For downstream projects like `hashicorp/terraform-provider-vault`, ensure you are using a version that incorporates the patched `uvicorn` library, such as one built from commit `1b2bcd8e14ca0bd56a16c6f547c07c72c8a1bad3` or later.

How to confirm the fix worked

To validate if an instance is vulnerable, send a request containing a percent-encoded ANSI escape sequence, such as `curl 'http://<target-host>:%1b[31mRED%1b[0m'`. Afterwards, view the uvicorn access log in a terminal. If the word 'RED' appears in red text, the instance is vulnerable. After applying the patch and re-running the test, the log entry should display the literal control characters (e.g., `^[[31mRED^[[0m`) instead of interpreting them, confirming the fix is effective.

Typical attack path

1. An attacker sends an HTTP request with a percent-encoded ANSI escape sequence in the URL path to a server running a vulnerable uvicorn version.
2. The uvicorn server decodes the URL and writes the raw escape sequence into its access log file.
3. A legitimate user, such as a developer or system administrator, views the log file in a terminal emulator.
4. The user's terminal emulator processes the malicious escape sequence, leading to log manipulation or potentially tricking the user into executing commands.
5. The attacker achieves their objective, such as hiding their tracks or gaining further access through the tricked user.

How to detect it

To detect potential exploitation, search historical and current uvicorn access logs for the presence of the ASCII escape character (`\x1b` or `^[`) followed by a left bracket (`[`). These sequences are not expected in legitimate URL paths. Log sources include stdout/stderr from the application process or any file configured for access logging. A SIEM rule can be created to alert on web requests where the request path contains `\x1b[` or its percent-encoded form, `%1b[`. Pay close attention to log entries that cause display issues or contain unusual character sequences when viewed in a terminal.

• \x1b[
• /%1b[
• \u001b[

What your security team should do

• Immediately upgrade all instances of the `uvicorn` package to version 0.11.5 or newer.
• Use dependency scanning tools to identify all applications and systems that rely on vulnerable versions of `uvicorn`.
• If patching is delayed, enforce safe log viewing practices by using commands like `cat -v` or `less -r` that render control characters harmlessly.
• Audit historical logs for indicators of compromise to determine if this vulnerability has been exploited.