PT-2024-18458 · Scrapy+3 · Scrapy+3
Published
2024-05-14
·
Updated
2025-05-05
·
CVE-2024-1968
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Scrapy versions prior to 2.11.2
Description
An issue was identified in Scrapy where the
Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the build redirect request function of the redirect middleware. In the context of a man-in-the-middle attack, this could be used to get access to the value of that Authorization header.Recommendations
Upgrade to Scrapy 2.11.2.
For versions prior to 2.11.2, consider replacing the built-in redirect middlewares with custom ones patched for this issue, but this requires manual patching.
As a temporary workaround, consider restricting access to sensitive information that could be exposed through the
Authorization header until a patch is applied.Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Scrapy
Ubuntu