CVE-2024-1968: Scrapy leaks the authorization header on same-domain but cross-origin redirects

May 14, 2024 (updated May 20, 2024)

Since version 2.11.1, Scrapy drops the Authorization header when a request is redirected to a different domain. However, it keeps the header if the domain remains the same but the scheme (http/https) or the port change, all scenarios where the header should also be dropped.

In the context of a man-in-the-middle attack, this could be used to get access to the value of that Authorization header

References

github.com/advisories/GHSA-4qqq-9vqf-3h3f
github.com/scrapy/scrapy
github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8
github.com/scrapy/scrapy/security/advisories/GHSA-4qqq-9vqf-3h3f
huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a
nvd.nist.gov/vuln/detail/CVE-2024-1968

Code Behaviors & Features

Detect and mitigate CVE-2024-1968 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →