CVE-2014-1830

Sensitive Information Exposure in Python Requests

• CVSS 5.0
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• Information Leakage
• Remote

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.

CVE

CVE-2014-1830

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CVSS base score

5.0

Published

2014-10-15

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Upgrade python-requests to version 2.3.0 or higher.

import SimpleHTTPServer
import SocketServer

PORT = 8000

Handler = SimpleHTTPServer.SimpleHTTPRequestHandler

httpd = SocketServer.TCPServer(("", PORT), Handler)

print("serving at port", PORT)
httpd.serve_forever()

import http.server
import os
import socketserver

PORT = 8000

class HTTPRequestHandler(http.server.SimpleHTTPRequestHandler):
    def translate_path(self, path):
        path = super().translate_path(path)
        root = os.path.abspath(self.directory)
        if not os.path.abspath(path).startswith(root):
            raise Exception("Unauthorized access to {}".format(path))
        return path

Handler = HTTPRequestHandler

with socketserver.TCPServer(("", PORT), Handler) as httpd:
    print("serving at port", PORT)
    httpd.serve_forever()

@misc{vaitp:cve20141830,
  title        = {{Sensitive Information Exposure in Python Requests}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2014},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-1830},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-1830/}}
}