PT-2024-40004 · Scrapy · Scrapy

Published 2024-05-14 · Updated 2024-05-14

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.11.2

Description The issue allows a malicious actor with write access to the start requests and read access to the spider output to exploit the vulnerability. This can be done by redirecting to any local file using the file:// scheme to read its contents, or to an ftp:// URL of a malicious FTP server to obtain the FTP username and password configured in the spider or project. Additionally, redirects to any s3:// URL can read its content using the S3 credentials configured in the spider or project. The vulnerability depends on how the spider implements its parsing of input data into an output item.

Recommendations Upgrade to Scrapy 2.11.2. As a temporary workaround, consider replacing the built-in retry middlewares (RedirectMiddleware and MetaRefreshMiddleware) with custom ones that implement the fix from Scrapy 2.11.2, and verify that they work as intended.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

GHSA-23J4-MW76-5V7H

Affected Products

Scrapy

References · 5

• https://osv.dev/vulnerability/GHSA-23j4-mw76-5v7h · Vendor Advisory
• https://github.com/scrapy/scrapy · Note
• https://github.com/scrapy/scrapy/security/advisories/GHSA-23j4-mw76-5v7h · Note
• https://github.com/scrapy/scrapy/issues/457 · Note
• https://github.com/scrapy/scrapy/commit/36287cb665ab4b0c65fd53181c9a0ef04990ada6 · Note