CVE-2022-23607: Unsafe handling of user-specified cookies in treq
Summary
CVE-2022-23607: Unsafe handling of user-specified cookies in treq. Affects treq versions < 22.1.0. Fixed in 22.1.0. How to fix ↓
Also tracked for
- python-treq · Debian:11
The same CVE-2022-23607 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Treq is a Python library that provides an HTTP client API. It allows users to send HTTP requests and handle responses. The library is commonly used for making HTTP requests in Python applications. However, a vulnerability has been discovered in treq that could potentially lead to the leakage of sensitive information due to unsafe handling of user-specified cookies.
Vulnerability Detail
The vulnerability in treq's request methods allows cookies specified by the user to be sent to every domain, making them "supercookies". This means that if a redirect occurs to a different domain, the cookie will be sent to that domain as well, potentially exposing sensitive information. For example, if a request is made to 'https://example.com' with a cookie 'session=1234', and the server redirects the request to 'http://cloudstorageprovider.com', the latter domain will receive the 'session' cookie. This can have serious security implications.
How To Fix
Minimum fixed version
22.1.0
This is the first release that contains the fix.
pip install --upgrade "treq==22.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Treq is not immediately possible, a workaround can be implemented by passing a http.cookiejar.CookieJar instance with properly domain- and scheme-scoped cookies instead of a dictionary as the 'cookies' argument. Here's an example:
from http.cookiejar import CookieJar
from requests.cookies import create_cookie
jar = CookieJar()
jar.add_cookie(
create_cookie(
name='session',
value='1234',
domain='example.com',
secure=True,
),
)
client = HTTPClient(cookies=jar)
client.get('https://example.com/')
Conclusion
The vulnerability in treq's handling of user-specified cookies can lead to the leakage of sensitive information. It is crucial to update Treq to version 2021.1.0 or later to fix the vulnerability. If immediate updating is not possible, the provided workaround can be used. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for treq →
FAQ
The vulnerability allows user-specified cookies to be sent to every domain, potentially exposing sensitive information. This can lead to unauthorized access, data leakage, and other security breaches.
To fix the vulnerability, update Treq to version 2021.1.0 or later. This update ensures that cookies are properly bound to the origin of the URL.
Yes, if updating Treq is not immediately possible, you can use the workaround mentioned earlier. Instead of passing a dictionary as the 'cookies' argument, pass a http.cookiejar.CookieJar instance with properly domain- and scheme-scoped cookies.
There is no known exploit available for this vulnerability at the moment. However, it is important to address the vulnerability promptly to prevent any potential security breaches.
Yes, the vulnerability has been fixed in Treq version 2021.1.0 and later. It is recommended to update to the latest version to ensure the security of your application.
