CVE-2024-1968 Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects

What is CVE-2024-1968?

CVE-2024-1968 is a high-severity vulnerability in scrapy/scrapy, published on 20 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.

Weakness: CWE-200

Which versions are affected by CVE-2024-1968?

3 open source packages ship an affected version, including scrapy and Scrapy. It affects 1 product.

Products include Scrapy Scrapy.

How do I fix CVE-2024-1968?

Upgrade scrapy to a fixed version for your release line: 2.0.0 or 2.11.2.

Is CVE-2024-1968 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1968 exists.

Other vulnerabilities in scrapy/scrapy

• CVE-2024-3572 XML External Entity (XXE) Vulnerability in scrapy/scrapy High 7.5
• CVE-2024-3574 Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy High 7.5
• CVE-2024-1892 ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider High 7.5
• CVE-2017-14158 Scrapy denial of service vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-1968, GHSA-4qqq-9vqf-3h3f, PYSEC-2024-258, UBUNTU-CVE-2024-1968, openSUSE-SU-2024:14130-1.