PT-2024-26692 · Scrapy+3 · Scrapy+3

Published 2024-02-15 · Updated 2025-05-05 · CVE-2024-3574

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.11.1

Description The issue arises from the failure to remove the Authorization header when redirecting across domains, potentially allowing for account hijacking. This occurs when a request with the Authorization header is sent to one domain, and the response asks to redirect to a different domain, causing Scrapy's built-in redirect middleware to create a follow-up redirect request that keeps the original Authorization header. The correct behavior would be to drop the Authorization header in this scenario.

Recommendations For Scrapy versions prior to 2.11.1, upgrade to Scrapy 2.11.1 to resolve the issue. If upgrading to Scrapy 2.11.1 is not an option and you are using Scrapy 1.8 or a lower version, upgrade to Scrapy 1.8.4 instead. As a temporary workaround, consider disabling the use of the Authorization header, either directly or through some third-party plugin. For requests that require the use of the Authorization header, add "dont redirect": True to the request.meta dictionary to disable following redirects for those requests. If same-domain redirect support is needed for requests using the Authorization header, ensure that the target website is trusted not to redirect requests to a different domain.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-3574

GHSA-4Q82-J5C2-G2C5

GHSA-CW9J-Q3VF-HRRV

USN-7476-1

Affected Products

Debian

Linuxmint

Scrapy

Ubuntu

References · 24

• https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-3574 · Security Note
• https://ubuntu.com/security/CVE-2021-41125 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-3574 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-3574 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3574 · Vendor Advisory
• https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9 · Patch
• https://ubuntu.com/security/CVE-2024-1968 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-3574 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7476-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0577 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-3574 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4q82-j5c2-g2c5 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-3574 · Security Note
• https://ubuntu.com/security/CVE-2024-1892 · Vendor Advisory