Information disclosure in Scrapy
CVE-2024-1968
In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (50.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Scrapy
- Scrapy Scrapy/scrapy — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a (Exploit, Third Party Advisory)
- github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8 (Patch)
Frequently asked questions
- What is CVE-2024-1968?
- CVE-2024-1968 is a high-severity vulnerability in Scrapy, classified under Information Disclosure. CVSS score: 7.5/10. Published 2024-05-20.
- How severe is CVE-2024-1968?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-1968 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.