CVE-2022-23607: treq - HTTP Library Supercookie Vulnerability
Summary
CVE-2022-23607: treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Affects treq versions >= 21.1.0, < 22.1.0. Fixed in 22.1.0. How to fix ↓
Also tracked for
- python-treq · Debian:11
The same CVE-2022-23607 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
treq is an HTTP library built on top of Twisted's Agents. It provides request methods and an HTTPClient constructor that accept cookies as a dictionary. These cookies are not bound to a single domain and are sent to every domain, making them "supercookies." This vulnerability allows sensitive information to leak when there is an HTTP redirect to a different domain. For example, if https://example.com redirects to http://cloudstorageprovider.com, the latter will receive the cookie session.
Vulnerability Detail
The vulnerability in treq versions 2021.1.0 and later lies in the way cookies are handled. Cookies given to request methods are not properly bound to the origin of the URL parameter, allowing them to be sent to unintended domains. This can result in the leakage of sensitive information. Users are advised to upgrade to treq version 22.1.0 or later. Alternatively, instead of passing a dictionary as the cookies argument, a http.cookiejar.CookieJar instance with properly domain- and scheme-scoped cookies can be used.
How To Fix
Minimum fixed version
22.1.0
This is the first release that contains the fix.
pip install --upgrade "treq==22.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not possible, a workaround is to use a http.cookiejar.CookieJar instance with properly domain- and scheme-scoped cookies instead of passing a dictionary as the cookies argument. Here's an example of how to create and use a CookieJar instance:
import http.cookiejar
cookie_jar = http.cookiejar.CookieJar()
cookie = http.cookiejar.Cookie(
version=0,
name='session',
value='your_session_value',
port=None,
port_specified=False,
domain='example.com',
domain_specified=True,
domain_initial_dot=False,
path='/',
path_specified=True,
secure=False,
expires=None,
discard=True,
comment=None,
comment_url=None,
rest={},
rfc2109=False
)
cookie_jar.set_cookie(cookie)
# Use the CookieJar instance with treq
import treq
response = treq.get('https://example.com', cookies=cookie_jar)
Conclusion
The treq HTTP library versions 2021.1.0 and later are vulnerable to a supercookie issue, which can lead to the leakage of sensitive information. Users are advised to upgrade to treq version 22.1.0 or later. If upgrading is not possible, the workaround of using a http.cookiejar.CookieJar instance with properly domain- and scheme-scoped cookies can be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for treq →
FAQ
treq is an HTTP library inspired by requests and built on top of Twisted's Agents. It provides convenient methods for making HTTP requests in Python.
A supercookie is a cookie that is not bound to a single domain and is sent to every domain. In the case of treq, this vulnerability allows supercookies to be sent to unintended domains, potentially leaking sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, if upgrading is not possible, you can use a http.cookiejar.CookieJar instance with properly domain- and scheme-scoped cookies instead of passing a dictionary as the cookies argument. Refer to the 'workaround' section for an example.
The recommended way to mitigate this vulnerability is to upgrade to treq version 22.1.0 or later. If upgrading is not possible, using the workaround mentioned above is an alternative solution.
