GHSA-4qqq-9vqf-3h3f
Suggest an improvement- Source
- https://github.com/advisories/GHSA-4qqq-9vqf-3h3f
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-4qqq-9vqf-3h3f/GHSA-4qqq-9vqf-3h3f.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-4qqq-9vqf-3h3f
- Aliases
- Published
- 2024-05-14T20:14:33Z
- Modified
- 2024-05-20T20:41:58.709463Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Scrapy leaks the authorization header on same-domain but cross-origin redirects
- Details
-
Impact
Since version 2.11.1, Scrapy drops the
Authorizationheader when a request is redirected to a different domain. However, it keeps the header if the domain remains the same but the scheme (http/https) or the port change, all scenarios where the header should also be dropped.In the context of a man-in-the-middle attack, this could be used to get access to the value of that
AuthorizationheaderPatches
Upgrade to Scrapy 2.11.2.
Workarounds
There is no easy workaround for unpatched versions of Scrapy. You can replace the built-in redirect middlewares with custom ones patched for this issue, but you have to patch them yourself, manually.
References
This security issue was reported and fixed by @szarny at https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a/.
- References
Affected packages
PyPI / scrapy
Package
- Name
- scrapy
- View open source insights on deps.dev
- Purl
- pkg:pypi/scrapy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.11.2
Affected versions
0.*
0.7
0.8
0.9
0.10.4.2364
0.12.0.2550
0.14.1
0.14.2
0.14.3
0.14.4
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.18.0
0.18.1
0.18.2
0.18.3
0.18.4
0.20.0
0.20.1
0.20.2
0.22.0
0.22.1
0.22.2
0.24.0
0.24.1
0.24.2
0.24.3
0.24.4
0.24.5
0.24.6
1.*
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.1.0rc1
1.1.0rc2
1.1.0rc3
1.1.0rc4
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.2.0
1.2.1
1.2.2
1.2.3
1.3.0
1.3.1
1.3.2
1.3.3
1.4.0
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.7.1
2.8.0
2.9.0
2.10.0
2.10.1
2.11.0
2.11.1