Credential Leakage Vulnerability in Requests Package: CVE-2024-47081
Summary
CVE-2024-47081: Requests is a HTTP library. Affects py3-requests across 2 version ranges.
< 2.32.4-r0
< 96ba401c1296ab1dda74a2365ef36d88f7d144ef
Fixed in 2.32.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Requests is a widely-used HTTP library in Python that simplifies making HTTP requests. It provides a user-friendly interface for sending HTTP requests and handling responses, making it a popular choice among developers. However, it is vulnerable to a specific issue related to URL parsing that can lead to the leakage of sensitive .netrc credentials when interacting with maliciously-crafted URLs.
Vulnerability Detail
The vulnerability, identified as CVE-2024-47081, arises from a flaw in the URL parsing mechanism of the Requests library. This flaw can allow attackers to craft specific URLs that, when accessed, may inadvertently expose .netrc credentials to third parties. The potential ramifications include unauthorized access to sensitive information, which could lead to further exploitation of user accounts or systems. This issue affects all versions of Requests prior to 2.32.4.
How To Fix
Minimum fixed version
2.32.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade py3-requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users who are unable to upgrade to the patched version, a temporary workaround is to disable the use of the .netrc file by setting trust_env=False when creating a Requests Session. Here is an example of how to implement this in your code:
import requests
session = requests.Session()
session.trust_env = False
Conclusion
In summary, CVE-2024-47081 is a significant vulnerability in the Requests library that can expose sensitive .netrc credentials through malicious URLs. Users are strongly encouraged to upgrade to version 2.32.4 or later to mitigate this risk. For those unable to upgrade, a temporary workaround is available by disabling the .netrc file usage.
See every vulnerability recorded for py3-requests →
FAQ
CVE-2024-47081 is a vulnerability in the Requests library that can lead to the leakage of .netrc credentials due to a URL parsing issue.
All versions of the Requests library prior to 2.32.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If upgrading is not possible, you can disable the use of the .netrc file by setting trust_env=False in your Requests Session.
The risks include unauthorized access to sensitive information, which could lead to further exploitation of user accounts or systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for py3-requests.
