PT-2022-13273 · Scrapy+2 · Scrapy+2

Published 2022-03-01 · Updated 2025-05-05 · CVE-2022-0577

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions scrapy versions prior to 2.6.1

Description The issue concerns the exposure of sensitive information to unauthorized actors. When a Request object is manually defined with cookies and receives a redirect response, the new Request object scheduled to follow the redirect retains those user-defined cookies, regardless of the target domain. This can lead to cookie leaks to unintended domains.

Recommendations For versions prior to 2.6.1, upgrade to Scrapy 2.6.0, which resets cookies when creating Request objects to follow redirects and drops the Cookie header if manually-defined cookies do not match the redirect target URL domain name. If upgrading to Scrapy 2.6.0 is not an option and you are using Scrapy 1.8 or a lower version, upgrade to Scrapy 1.8.2 instead. As a temporary workaround, set cookies using a list of dictionaries instead of a single dictionary, and set the right domain for each cookie. Alternatively, consider disabling cookies altogether or limiting target domains to trusted ones.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2022-0577

DLA-2950-1

GHSA-CJVR-MFJ7-J4J8

OPENSUSE-SU-2024:11889-1

PYSEC-2022-159

USN-7476-1

Affected Products

Linuxmint

Ubuntu

Scrapy

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0577.json · Exploit
• 🔥 https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585 · Exploit
• https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0577 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-0577 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41125 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2950-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0577 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-0577 · Security Note
• https://ubuntu.com/security/CVE-2024-3574 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1968 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-159 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjvr-mfj7-j4j8 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7476-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0577 · Vendor Advisory