oss-security - CVE Request for python-requests session fixation vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 14 Mar 2015 11:50:48 -0500
From: Ian Cordasco <graffatcolmingov@...il.com>
To: oss-security@...ts.openwall.com
Cc: Cory Benfield <cory@...asa.co.uk>, Matthew Daley <mattd@...fuzz.com>, requests@...relist.org
Subject: CVE Request for python-requests session fixation vulnerability

Last night, Matthew Daley (CC'd on this email) privately disclosed to
the requests project a vulnerability in requests which has now been
fixed in requests v2.6.0
(https://warehouse.python.org/project/requests/2.6.0/) by this commit:
https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc.

The following is the relevant excerpts from the description provided by Matthew:

The issue occurs when Requests is handling a HTTP response that is a
redirection and that also sets cookies without an explicit domain
parameter. Instead of the cookies only being set for the domain which
sent the HTTP response, they are also sent to the redirection target,
regardless of its domain.

The issue could be exploited in the following ways:
* If you are the redirection source (ie. you can make Requests hit
your URL), you can make Requests perform a request to any third-party
domain with cookies of your choosing. This may be useful in performing
a session fixation attack.
* If you are the redirection target (ie. you can make a third-party
site redirect to your URL), you are able to steal any cookies set by
the third-party redirection.

The change that introduced this vulnerability was first included in
version 2.1.0 of requests. As such every version since that version up
to and including 2.5.3 are vulnerable to this attack.

Please assign an identifier for this.

Thank you,
Ian Cordasco

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.