CVE-2024-3574: Scrapy Scrapy Authorization Header Leakage On Vulnerability
HIGHCVE-2024-3574 is a HIGH (CVSS 7.5) scrapy authorization header leakage on vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Scrapy libraries in the PyPI ecosystem. The issue involves scrapy authorization header leakage on cross-domain redirect. Remediation is available by upgrading affected packages to version 2.11.1, 1.8.4.
CVE-2024-3574 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2024-3574
To remediate this vulnerability, upgrade all affected Scrapy dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install scrapy>=2.11.1pip install scrapy>=1.8.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show scrapyHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2024-3574, inspect your installed packages using pip:
pip show scrapyAnalyze the terminal output to locate any version of Scrapy in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.11.1), your application is affected.
Note: The pip show scrapy command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Scrapy, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-3574 Affected Scrapy Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
scrapy
|
PyPI |
≥ 2
< 2.11.1
|
2.11.1
|
|
scrapy
|
PyPI |
< 1.8.4
|
1.8.4
|
References
Frequently Asked Questions
What is CVE-2024-3574?
Which Scrapy versions are affected?
What version fixes CVE-2024-3574?
Is scrapy affected?
What is the CVSS score of CVE-2024-3574?
What CWE is associated with CVE-2024-3574?
How can I check PyPI dependencies for CVE-2024-3574?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-cw9j-q3vf-hrrv",
"modified" : "2024-04-16T14:05:51Z",
"published" : "2024-02-15T15:32:15Z",
"aliases" : [ "CVE-2024-3574" ],
"summary" : "Scrapy authorization header leakage on cross-domain redirect",
"details" : "### Impact\n\nWhen you send a request with the `Authorization` header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original `Authorization` header, leaking its content to that second domain.\n\nThe [right behavior](https://fetch.spec.whatwg.org/#ref-for-cors-non-wildcard-request-header-name) would be to drop the `Authorization` header instead, in this scenario.\n\n### Patches\n\nUpgrade to Scrapy 2.11.1.\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.11.1 is not an option, you may upgrade to Scrapy 1.8.4 instead.\n\n### Workarounds\n\nIf you cannot upgrade, make sure that you are not using the `Authentication` header, either directly or through some third-party plugin.\n\nIf you need to use that header in some requests, add `\"dont_redirect\": True` to the `request.meta` dictionary of those requests to disable following redirects for them.\n\nIf you need to keep (same domain) redirect support on those requests, make sure you trust the target website not to redirect your requests to a different domain.\n\n### Acknowledgements\n\nThis security issue was reported by @ranjit-git [through huntr.com](https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9/).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "scrapy"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2"
}, {
"fixed" : "2.11.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "scrapy"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.8.4"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-3574"
}, {
"type" : "WEB",
"url" : "https://github.com/scrapy/scrapy/commit/ee7bd9d217fc126063575d5649f00bdeeca2faae"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/scrapy/scrapy"
}, {
"type" : "WEB",
"url" : "https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-02-15T15:32:15Z",
"nvd_published_at" : null
}
}