Bug 1222886 (CVE-2024-3574) - VUL-0: CVE-2024-3574: python-Scrapy: Authorization header leakage on cross-domain redirect
Summary: VUL-0: CVE-2024-3574: python-Scrapy: Authorization header leakage on cross-do...
Status: RESOLVED FIXED
Alias: CVE-2024-3574
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Dirk Mueller
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/401987/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-16 09:31 UTC by SMASH SMASH
Modified: 2024-05-29 17:33 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-16 09:31:36 UTC 
In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-3574
https://www.cve.org/CVERecord?id=CVE-2024-3574
https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75
https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9
https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
Comment 1 Robert Frohl 2024-04-16 09:32:41 UTC 
already fixed, only missing reference. Closing