Information Exposure Affecting requests package, versions [2.3.0,2.31.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-REQUESTS-5595532
- published 23 May 2023
- disclosed 22 May 2023
- credit Dennis Brinkrolf, Tobias Funke
Introduced: 22 May 2023
CVE-2023-32681 Open this link in a new tabHow to fix?
Upgrade requests to version 2.31.0 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure by leaking Proxy-Authorization headers to destination servers during redirects to an HTTPS origin. This is a result of how rebuild_proxies is used to recompute and reattach the Proxy-Authorization header to requests when redirected.
NOTE: This behavior has only been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. https://username:password@proxy:8080), and only when redirecting to HTTPS:
HTTP → HTTPS: leak
HTTPS → HTTP: no leak
HTTPS → HTTPS: leak
HTTP → HTTP: no leak
For HTTP connections sent through the proxy, the proxy will identify the header in the request and remove it prior to forwarding to the destination server. However when sent over HTTPS, the Proxy-Authorization header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.
Workaround
This vulnerability can be avoided by setting allow_redirects to False on all calls through Requests top-level APIs, and then capturing the 3xx response codes to make a new request to the redirect destination.