Cross-Origin Redirect Vulnerability in Python urllib3: Authorization Header Exposure
Summary
CVE-2018-25091: urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). Affects python-urllib3 across 2 version ranges.
< 1.25.6-4
< adb358f8e06865406d1f05e581a16cbea2136fbc
Fixed in 1.25.6-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python urllib3 is a powerful HTTP library that enables users to send HTTP requests and handle responses in a straightforward manner. It is widely used in various applications for its ease of use and robust features, including connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. However, a vulnerability has been identified in versions prior to 1.24.2, where the library fails to remove the authorization HTTP header during cross-origin redirects, potentially exposing sensitive credentials.
Vulnerability Detail
The vulnerability, identified as CVE-2018-25091, arises from urllib3's failure to adequately handle authorization headers when following cross-origin redirects. This oversight can lead to sensitive information, such as API keys or user credentials, being sent to unintended hosts, thereby increasing the risk of unauthorized access and data breaches. The issue is compounded by an incomplete fix for a related vulnerability (CVE-2018-20060), which was case-sensitive. The CVSS score for this vulnerability is 6.1, indicating a medium severity level.
How To Fix
Minimum fixed version
1.25.6-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually inspect and remove the authorization header from requests before following redirects. However, this is not a permanent solution and upgrading the library is strongly recommended.
Conclusion
The CVE-2018-25091 vulnerability in Python urllib3 poses a significant risk by allowing the exposure of authorization headers during cross-origin redirects. Users are strongly advised to upgrade to the latest version of the library to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python-urllib3 →
FAQ
CVE-2018-25091 is a vulnerability in the Python urllib3 library that allows the authorization HTTP header to be exposed during cross-origin redirects.
The main risk is the exposure of sensitive credentials to unintended hosts, which can lead to unauthorized access and data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The recommended action is to upgrade urllib3 to version 1.25.6-4 or later to ensure the vulnerability is patched.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-urllib3.
