CVE-2017-7235: cfscrape - Arbitrary Code Execution
Summary
CVE-2017-7235: An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. Affects cfscrape versions >= 1.6.6, < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cfscrape is a Python package available on PyPI that provides a simple interface for scraping Cloudflare-protected websites. It allows users to bypass Cloudflare's anti-bot page, making it easier to scrape data from websites that employ Cloudflare protection. This vulnerability affects versions 1.6.6 through 1.7.1 of cfscrape.
Vulnerability Detail
The vulnerability (CVE-2017-7235) in cfscrape versions 1.6.6 through 1.7.1 allows a malicious website owner to execute arbitrary Python code against any user who scrapes their website using cfscrape. By crafting a specific page, an attacker can exploit this vulnerability and execute arbitrary code on the victim's system. This can lead to unauthorized access, data leakage, or even complete compromise of the user's machine.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
pip install --upgrade "cfscrape==1.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in cfscrape versions 1.6.6 through 1.7.1 allows for arbitrary code execution, which can lead to serious security risks. It is recommended that users upgrade to version 1.8.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cfscrape →
FAQ
cfscrape is a Python package that allows users to bypass Cloudflare's anti-bot page and scrape data from Cloudflare-protected websites.
Versions 1.6.6 through 1.7.1 of cfscrape are affected by this vulnerability.
An attacker can exploit this vulnerability by crafting a malicious page that executes arbitrary Python code against users who scrape that website using cfscrape.
The potential consequences of this vulnerability include unauthorized access, data leakage, and complete compromise of the user's system.
To fix this vulnerability, users should upgrade to version 1.8.0 or later of cfscrape.
