PT-2021-23107 · Unknown · Scrapy-Splash

Gallaecio · Published 2021-10-05 · Updated 2021-10-14 · CVE-2021-41124

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions scrapy-splash versions prior to 0.8.0

Description The issue affects users who utilize HttpAuthMiddleware for Splash authentication, causing non-Splash requests to expose credentials to the request target. This includes robots.txt requests sent by Scrapy when the ROBOTSTXT OBEY setting is set to True.

Recommendations Upgrade to scrapy-splash 0.8.0 and use the new SPLASH USER and SPLASH PASS settings to set Splash authentication credentials safely. If you cannot upgrade, set your Splash request credentials on a per-request basis using the splash headers request parameter, instead of defining them globally using the HttpAuthMiddleware. Alternatively, make sure all your requests go through Splash by disabling the robots.txt middleware.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-41124

GHSA-823F-CWM9-4G74

PYSEC-2021-364

Affected Products

Scrapy-Splash

References · 11

• https://github.com/scrapy-plugins/scrapy-splash/commit/2b253e57fe64ec575079c8cdc99fe2013502ea31 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41124 · Security Note
• https://osv.dev/vulnerability/GHSA-823f-cwm9-4g74 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41124 · Vendor Advisory
• https://github.com/scrapy-plugins/scrapy-splash/security/advisories/GHSA-823f-cwm9-4g74 · Note
• https://github.com/scrapy-plugins/scrapy-splash/releases/tag/0.8.0 · Note
• https://github.com/scrapy-plugins/scrapy-splash · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/scrapy-splash/PYSEC-2021-364.yaml · Note
• https://t.me/cibsecurity/30009 · Telegram Post
• https://t.me/cvenotify/21954 · Telegram Post