GHSA-mfjm-vh54-3f96 Scrapy cookie-setting is not restricted based on the public suffix list
Scrapy allows malicious sites to set cookies for other domains sharing a public suffix, enabling session hijacking or data leakage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-mfjm-vh54-3f96?
GHSA-mfjm-vh54-3f96 is a vulnerability in scrapy, published on 1 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from example.co.uk, given its public domain name suffix is co.uk) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.
Patches
Upgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the public suffix list.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.
Workarounds
The only workaround for unpatched versions of Scrapy is to disable cookies altogether, or limit target domains to a subset that does not include domain names with one of the public domain suffixes affected (those with 1 or more periods).
References
For more information
If you have any questions or comments about this advisory:
Which versions are affected by GHSA-mfjm-vh54-3f96?
4 open source packages ship an affected version, including scrapy.
| Package | Affected | Fixed in |
|---|---|---|
scrapy PyPI | All versions | 1.8.2 |
scrapy PyPI | All versions | 1.8.2 |
scrapy PyPI | From 2.0.0 | 2.6.0 |
scrapy PyPI | From 2.0.0 | 2.6.0 |
How do I fix GHSA-mfjm-vh54-3f96?
Upgrade scrapy to a fixed version for your release line: 1.8.2 or 2.6.0.
Is GHSA-mfjm-vh54-3f96 being exploited?
There is no known exploitation of GHSA-mfjm-vh54-3f96 in the wild and no public exploit code.