CVE-2024-1968: Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects
Impact
Since version 2.11.1, Scrapy drops the Authorization header when a request is redirected to a different domain. However, it keeps the header if the domain remains the same but the scheme (http/https) or the port change, all scenarios where the header should also be dropped.
In the context of a man-in-the-middle attack, this could be used to get access to the value of that Authorization header
Patches
Upgrade to Scrapy 2.11.2.
Workarounds
There is no easy workaround for unpatched versions of Scrapy. You can replace the built-in redirect middlewares with custom ones patched for this issue, but you have to patch them yourself, manually.
References
This security issue was reported and fixed by @szarny at https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a/.
Other sources
In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the buildredirectrequest function of the redirect middleware.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1968?
CVE-2024-1968 is considered a significant vulnerability due to the potential exposure of sensitive `Authorization` headers during domain redirections.
How do I fix CVE-2024-1968?
To fix CVE-2024-1968, upgrade Scrapy to version 2.11.2 or later.
What versions of Scrapy are affected by CVE-2024-1968?
Scrapy versions before 2.11.2 are affected by CVE-2024-1968.
What does CVE-2024-1968 affect in Scrapy?
CVE-2024-1968 affects the handling of the `Authorization` header during HTTP redirections in Scrapy.
Is CVE-2024-1968 a remote code execution vulnerability?
CVE-2024-1968 is not a remote code execution vulnerability; it relates to the improper handling of HTTP headers.