Date: Sat, 14 Mar 2015 11:50:48 -0500 From: Ian Cordasco <graffatcolmingov@...il.com> To: oss-security@...ts.openwall.com Cc: Cory Benfield <cory@...asa.co.uk>, Matthew Daley <mattd@...fuzz.com>, requests@...relist.org Subject: CVE Request for python-requests session fixation vulnerability Last night, Matthew Daley (CC'd on this email) privately disclosed to the requests project a vulnerability in requests which has now been fixed in requests v2.6.0 (https://warehouse.python.org/project/requests/2.6.0/) by this commit: https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc. The following is the relevant excerpts from the description provided by Matthew: The issue occurs when Requests is handling a HTTP response that is a redirection and that also sets cookies without an explicit domain parameter. Instead of the cookies only being set for the domain which sent the HTTP response, they are also sent to the redirection target, regardless of its domain. The issue could be exploited in the following ways: * If you are the redirection source (ie. you can make Requests hit your URL), you can make Requests perform a request to any third-party domain with cookies of your choosing. This may be useful in performing a session fixation attack. * If you are the redirection target (ie. you can make a third-party site redirect to your URL), you are able to steal any cookies set by the third-party redirection. The change that introduced this vulnerability was first included in version 2.1.0 of requests. As such every version since that version up to and including 2.5.3 are vulnerable to this attack. Please assign an identifier for this. Thank you, Ian Cordasco
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.