[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <fa53c264-08ef-4ddd-a610-b56ab65d3a79@gmail.com>
Date: Tue, 3 Jun 2025 20:53:15 -0400
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2024-47081: Netrc credential leak in PSF
requests library
On 6/3/25 13:09, Alan Coopersmith wrote:
> [I'm not sure how the attacker is supposed to get the victim to make a
> requests call using a URL the attacker controls, but that didn't stop
> them from getting a CVE issued for this. -alan- ]
Suppose that a server (like a web scraper) receives URLs that are
attacker-controlled, validates that the point to the expected domain
name, and then fetches them. In this case, Requests will send
credentials for a domain name that is *not* the one that it is
supposed to send them for, which is clearly a vulnerability.
It's definitely better to reconstruct the URL from scheme, authority,
path, and query before sending the request, but I am almost certain
there are servers in the wild that do not do this.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
