Miggo Logo
Miggo Vulnerability Database
→
GHSA-4q82-j5c2-g2c5

GHSA-4q82-j5c2-g2c5: Duplicate Advisory: Scrapy authorization header leakage on cross-domain redirect

7.5

CVSS Score
3.0

Basic Information

CVE ID
-
GHSA ID
GHSA-4q82-j5c2-g2c5
EPSS Score
-
CWE
CWE-200
Published
4/16/2024
Updated
4/16/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
scrapypip< 2.11.12.11.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the redirect handling logic in _build_redirect_request function. The commit diff shows this function was modified to add Authorization header removal when domains differ. Before the patch, it only removed Cookie headers during cross-domain redirects but didn't check Authorization headers. The added test_cross_domain_header_dropping in test_downloadermiddleware_redirect.py confirms this was the vulnerable path. The function's responsibility to sanitize headers during redirect creation makes it the clear vulnerability source.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## *upli**t* **visory T*is **visory **s ***n wit**r*wn ****us* it is * *upli**t* o* **S*-*w*j-q*v*-*rrv. T*is link is m*int*in** to pr*s*rv* *xt*rn*l r***r*n**s. ## Ori*in*l **s*ription In s*r*py v*rsions ***or* *.**.*, *n issu* w*s i**nti*i** w**r*

Reasoning

T** vuln*r**ility st*ms *rom t** r**ir**t **n*lin* lo*i* in _*uil*_r**ir**t_r*qu*st *un*tion. T** *ommit *i** s*ows t*is *un*tion w*s mo*i*i** to *** *ut*oriz*tion *****r r*mov*l w**n *om*ins *i***r. ***or* t** p*t**, it only r*mov** *ooki* *****rs *