PT-2024-26670 · Scrapy+4 · Scrapy+4

Published 2024-02-16 · Updated 2025-05-05 · CVE-2024-3572

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions scrapy/scrapy (affected versions not specified)

Description The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This issue allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data. Additionally, Scrapy is vulnerable to decompression bombs, which could exhaust the memory available to the Scrapy process.

Recommendations Upgrade to Scrapy 2.11.1. If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.11.1 is not an option, you may upgrade to Scrapy 1.8.4 instead. As a temporary workaround, consider manually backporting the 2.11.1 or 1.8.4 fix, replacing the corresponding components of an unpatched version of Scrapy with patched versions copied into your own code.

Exploit

Fix

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2024-3572

GHSA-7J7M-V7M3-JQM7

GHSA-RMQV-7V3J-MR7P

USN-7476-1

Affected Products

Debian

Linuxmint

Ubuntu

Lxml

Scrapy

References · 24

• 🔥 https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb · Exploit
• https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f · Patch
• https://ubuntu.com/security/CVE-2021-41125 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3574 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-3572 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1968 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rmqv-7v3j-mr7p · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-3572 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7476-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-3572 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0577 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3572 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3572 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1892 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3572 · Vendor Advisory