search

fecgov / fec-eregs

The Federal Election Commission's web-based application that makes regulations easier to find, read and understand.
https://www.fec.gov/regulations/
Other
33 stars 13 forks source link

[Snyk:Medium] requests Information Exposure (due by 07/23/2023) #765

Closed cnlucas closed 1 year ago

cnlucas commented 1 year ago

Introduced through requests@2.26.0 and requests-toolbelt@0.8.0 Fixed in requests@2.31.0

Exploit maturity
No known exploit

Detailed paths and remediation

Introduced through: project@0.0.0 › requests@2.26.0
Fix: Upgrade requests to version 2.31.0

Introduced through: project@0.0.0 › requests-toolbelt@0.8.0 › requests@2.26.0 Fix: Pin requests to version 2.31.0

Security information Factors contributing to the scoring:

Snyk: [CVSS 6.1](https://security.snyk.io/vuln/SNYK-PYTHON-REQUESTS-5595532) - Medium Severity
NVD: Not available. NVD has not yet published its analysis.

Why are the scores different? Learn how Snyk evaluates vulnerability scores Overview

Affected versions of this package are vulnerable to Information Exposure by leaking Proxy-Authorization headers to destination servers during redirects to an HTTPS origin. This is a result of how rebuild_proxies is used to recompute and reattach the Proxy-Authorization header to requests when redirected.

NOTE: This behavior has only been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. https://username:password@proxy:8080), and only when redirecting to HTTPS:

HTTP → HTTPS: leak

HTTPS → HTTP: no leak

HTTPS → HTTPS: leak

HTTP → HTTP: no leak

For HTTP connections sent through the proxy, the proxy will identify the header in the request and remove it prior to forwarding to the destination server. However when sent over HTTPS, the Proxy-Authorization header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.

Completion criteria

(What does the end state look like - as long as this task(s) is done, this work is complete)

pkfec commented 1 year ago

requests package was upgraded in pr https://github.com/fecgov/fec-eregs/pull/766. No further action required. Hence closing this issue