Session Cookie Exposure Vulnerability in HTTPie
Summary
CVE-2022-24737: HTTPie is a command-line HTTP client. Affects httpie versions 2.2.0-2 – 3.2.4-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HTTPie is a command-line HTTP client designed for making HTTP requests easier to use and understand. It provides a user-friendly interface for interacting with APIs and web services, allowing users to send requests and view responses in a readable format. One of its key features is the ability to manage sessions, which allows users to store state information, including cookies, for subsequent requests. However, a vulnerability was discovered that affects how HTTPie handles cookies during redirects, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from HTTPie's failure to distinguish between cookies and the hosts they belong to prior to version 3.1.0. This oversight means that when a user is redirected from the original host to a third-party website, some cookies may be inadvertently exposed. This could lead to unauthorized access to user sessions or sensitive data, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to upgrade to the fixed version as soon as possible.
Conclusion
CVE-2022-24737 represents a significant security vulnerability in HTTPie, specifically related to session cookie management. Users are strongly advised to upgrade to the latest version to mitigate the risks associated with this vulnerability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for httpie →
FAQ
CVE-2022-24737 is a vulnerability in HTTPie that allows for the exposure of session cookies during redirects to third-party websites.
You can check your version of HTTPie by running 'http --version' in your command line. If it is below 3.2.1-1, it is affected.
The primary risk is the unauthorized exposure of session cookies, which could lead to session hijacking and unauthorized access to user accounts.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground.
The CVSS score for CVE-2022-24737 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for httpie.
