CVE-2018-18074: Insufficiently Protected Credentials in Requests

Background

The Requests package is a popular Python library used for making HTTP requests. It provides a simple and intuitive API for sending HTTP requests and handling responses. The package is widely used in various Python applications and frameworks. However, versions of Requests before 2.19.1 (released before September 14, 2018) are vulnerable to an issue that can lead to the exposure of credentials. This vulnerability occurs when Requests sends an HTTP Authorization header to an HTTP URI after receiving a same-hostname HTTPS-to-HTTP redirect. This behavior makes it easier for remote attackers to discover credentials by sniffing the network.

Vulnerability Detail

The vulnerability (CVE-2018-18074) in the Requests package allows an attacker to potentially intercept and obtain sensitive credentials. When a same-hostname HTTPS-to-HTTP redirect occurs, Requests mistakenly sends the Authorization header to the insecure HTTP URI. This can expose credentials, such as usernames and passwords, to attackers who can intercept network traffic. The impact of this vulnerability depends on the sensitivity of the credentials and the network environment. It is important to note that this vulnerability only affects versions of Requests before 2.19.1.

pip install --upgrade "requests==2.34.2"

pip install --upgrade "requests==2.20.0"

Workaround

If upgrading to the latest version of Requests is not immediately possible, a possible workaround is to manually modify the code to prevent the sending of credentials in the Authorization header when a same-hostname HTTPS-to-HTTP redirect occurs. This can be achieved by checking the URL scheme before sending the request and excluding the Authorization header if the scheme is HTTP. Here is an example of how this can be implemented in Python:

import requests

url = 'http://example.com'

if url.startswith('https://'): response = requests.get(url, auth=('username', 'password')) else: response = requests.get(url)

print(response.text)

Conclusion

The vulnerability in the Requests package (CVE-2018-18074) can potentially expose sensitive credentials to attackers. It is important to upgrade to version 2.20.0 or later of the Requests package to fix this issue. If immediate upgrading is not possible, a workaround can be implemented to prevent the sending of credentials in the Authorization header. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for requests →

FAQ