Cross-Origin Credential Exposure in urllib3: CVE-2018-20060
Summary
CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). Affects python-urllib3 across 2 version ranges.
< 1.24-1
< 7c216f433e39e184b84cbfa49e41135a89e4baa0
Fixed in 1.24-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python that is widely used for making HTTP requests. It provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. However, prior to version 1.23, urllib3 had a critical vulnerability that allowed the Authorization HTTP header to be sent to unintended hosts during cross-origin redirects, potentially exposing sensitive credentials.
Vulnerability Detail
The vulnerability, identified as CVE-2018-20060, arises from urllib3's failure to remove the Authorization HTTP header when following a cross-origin redirect. This means that if a user is redirected to a different host, their credentials contained in the Authorization header could be inadvertently sent to that new host. This exposure can lead to unauthorized access and data breaches, as sensitive information may be transmitted in cleartext. The vulnerability affects all versions of urllib3 before 1.23.
How To Fix
Minimum fixed version
1.24-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually remove the Authorization header from requests before following redirects. This can be achieved by modifying the request code to exclude the header when making cross-origin requests. For example:
import urllib3
http = urllib3.PoolManager() response = http.request('GET', 'http://example.com', headers={'Authorization': None})
Conclusion
CVE-2018-20060 is a critical vulnerability in urllib3 that can expose sensitive credentials through cross-origin redirects. It is essential for users to upgrade to version 1.24-1 or later to mitigate this risk. Implementing workarounds can provide temporary relief, but upgrading is the best long-term solution.
See every vulnerability recorded for python-urllib3 →
FAQ
CVE-2018-20060 is a vulnerability in urllib3 that allows the Authorization HTTP header to be sent to unintended hosts during cross-origin redirects, potentially exposing sensitive credentials.
All versions of urllib3 prior to 1.23 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2018-20060 is 9.8, indicating a critical level of severity.
If you cannot upgrade immediately, consider implementing a workaround by manually removing the Authorization header from requests before following redirects.
Related vulnerabilities
Recent vulnerabilities recorded for python-urllib3.
