CVE-2024-1682 Unclaimed S3 Bucket Reference in psf/requests Documentation
Attackers can hijack an unclaimed S3 bucket referenced in documentation to serve malicious content or leak data to users of the requests library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-1682?
CVE-2024-1682 is a medium-severity vulnerability in psf/requests, published on 14 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks.
Weakness: CWE-840
Which versions are affected by CVE-2024-1682?
How do I fix CVE-2024-1682?
Apply the vendor's patch.
Is CVE-2024-1682 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1682 exists.
Sources
Also known as GHSA-44cv-hr8r-whc9, OESA-2024-2431, OESA-2024-2432, OESA-2024-2433, OESA-2024-2434.