GHSA-823f-cwm9-4g74

Suggest an improvement
Source
https://github.com/advisories/GHSA-823f-cwm9-4g74
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-823f-cwm9-4g74/GHSA-823f-cwm9-4g74.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-823f-cwm9-4g74
Aliases
Related
Published
2021-10-06T17:49:23Z
Modified
2026-03-13T22:16:01.343500Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
Splash authentication credentials potentially leaked to target websites
Details

Impact

If you use HttpAuthMiddleware (i.e. the http_user and http_pass spider attributes) for Splash authentication, any non-Splash request will expose your credentials to the request target. This includes robots.txt requests sent by Scrapy when the ROBOTSTXT_OBEY setting is set to True.

Patches

Upgrade to scrapy-splash 0.8.0 and use the new SPLASH_USER and SPLASH_PASS settings instead to set your Splash authentication credentials safely.

Workarounds

If you cannot upgrade, set your Splash request credentials on a per-request basis, using the splash_headers request parameter, instead of defining them globally using the HttpAuthMiddleware.

Alternatively, make sure all your requests go through Splash. That includes disabling the robots.txt middleware.

For more information

If you have any questions or comments about this advisory: * Open an issue * Email us

Database specific 
{
    "github_reviewed": true,
    "severity": "HIGH",
    "github_reviewed_at": "2021-10-05T21:11:11Z",
    "nvd_published_at": "2021-10-05T21:15:00Z",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

PyPI / scrapy-splash

Package

Name
scrapy-splash
View open source insights on deps.dev
Purl
pkg:pypi/scrapy-splash

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.8.0

Affected versions

0.*
0.2
0.3
0.4
0.5
0.6
0.6.1
0.7
0.7.1
0.7.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-823f-cwm9-4g74/GHSA-823f-cwm9-4g74.json"